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(54) System and method for quantitative competition and recording medium having recorded 
thereon program for implementing them 



(57) A bid-opening device 20 receives from each 
bidding device 10 m a bidding price index y m = g(h k (IV m )) 
(where IV m is an initial value, h k indicates k-times 
processing with a one-way function h and g is a one- 
way function) and its identifier ID m . The received infor- 
mation is stored on a common bulletin board 25. D m = 
nk ( ,v m) (where D m = g(D m ) is generated with k set as 
the upper limit value K of the bidding price. The bulletin 



board 25 is checked for y m which matches this D m . If no 
match is found, m is incremented by one, and the check 
for 7m" D m matching is made for each of m bidding de- 
vices. Upon completion of the matching for all the bid- 
ding devices, k is decremented by one, and a check is 
made for for y m which matches D m = g(h k (l V m )), and the 
index k for which they match is determined as the high- 
est price bid. The bid-opening device 20 outputs that k 
and the identifier ID m of y m . 
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Description 

BACKGROUND OF THE INVENTION 

[0001] The present invention relates to a quantitative s 
competition system and method which compare aimed 
or intended values of participants and publish the high- 
est or lowest value but hide the other values, and a re- 
cording medium on which there is recorded a program 
tor implementing the method. More particularly, the in- 10 
vention pertains to a system and method for quantitative 
comparison of secret values, for example, in electronic 
lottery, electronic voting, or electronic sealed-bid auc- 
tion under circumstances where many participants are 
allowed to access the server online across the Internet, is 
[0002] Fig. 1 is depicts in block form the configuration 
of a conventional electronic competitive bidding or 
sealed-bid auction system. A notice of auction is input 
to bidding devices 10 1 to 10 M , which send their identifi- 
ers ID 1 to ID M and bidding prices PR, to PR M to a bid- 20 
opening device 20. In this transfer of each data, if it is 
desirable to keep the data secret, the bidding price is 
sent in compressed form, and if it is necessary to identify 
the data, it is sent together with a digital signature of the 
bidder. The bid-opening device 20 detects the highest 25 
(or lowest) one of the bid values received from the bid- 
ding devices to 10 M , and outputs the winning bid 
and the identifier corresponding thereto. This scheme is 
disclosed, for example, in Japanese Patent Application 
Laid-Open Gazette No. 118876/90 entitled "Electronic 30 
Bidding System." On the other hand, schemes which 
publish only the winning bid but hide other information 
involved are disclosed, for example, in Kazuo SAKO, 
"Auction Protocol Which Hides Bids of Losers," The 
Symposium on Cryptography and Information Security, 3S 
SCIS'99, and in Shingo MIYAZAKI and Kouichi 
SAKURAI, "A Bulletin-Board Base Digital Auction 
Scheme with Bidding Down Strategy, " The Symposium 
on Cryptography and Information Security SCIS'99. 
[0003] The sealed-bid auction scheme to which the 40 
present invention is applied satisfies the requirements 
mentioned below. 

* Only bidding prices are used to determine the win- 
ning bid; that is, the successful bidding device is not *s 
determined using other information. 

* The bid-opening device and a provisional identifier 
registration device neither cheat nor malfunction. 

SUMMARY OF THE INVENTION 50 

[0004] It is therefore an object of the present invention 
to provide a quantitative competition system and meth- 
od which ensure the fairness of a sealed-bid auction, 
the validity of a successful bid value, the undeniability 55 
of bidders, the anonymity of the bidders and the freedom 
from double bidding. 

[0005] The fai mess of an auction means that it is pos- 



sible to prevent bidders from obtaining information on 
other bidding devices prior to bidding in an attempt to 
make bids with unfair advantage. 
[0006] The validity of a successful bid value means 
that it is possible to prevent an unfair determination of 
the winning bid. 

[0007] The undeniability of bidders means that it is 
possible to prevent them from denying their bid values 
at the bid-opening time. 

[0008] The anonymity of bidders means that it is pos- 
sible to prevent leakage of identification information of 
every bidding device. 

[0009] According to the present invention, each bid- 
ding device transforms its bidding price to bidding price 
information through utilization of a one-way function, 
and the bid-opening device uses the bidding price infor- 
mation to determine the successful bid without revealing 
the prices bid by unsuccessful bidders. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0010] 

Fig. 1 is a block diagram showing the general con- 
figuration of an electronic competitive bidding sys- 
tem; 

Fig. 2 is a flowchart showing the general procedure 
of an electronic sealed-bid auction; 
Fig. 3 is a block diagram depicting a bidding device 
which uses one-way functions to generate a bid in- 
dex; 

Fig. 4 is a block diagram depicting a concrete ex- 
ample of a bidding price transformer using one-way 
function processors; 

Fig. 5 is a flowchart showing the procedure for gen- 
erating the bid index through the use of one-way 
functions; 

Fig. 6 is a block diagram illustrating the functional 
configuration of a bid-opening device 20 in a first 
embodiment of the present invention which is de- 
signed to determine the highest price bid as the win- 
ning bid; 

Fig. 7 is a flowchart showing the operation of the 
bid-opening device 20 depicted in Fig. 6; 
Fig. 8 is a block diagram illustrating the functional 
configuration of a bid-opening device in a second 
embodiment of the present invention; 
Fig. 9 is a flowchart showing the operation of the 
bid-opening device depicted in Fig. 8; 
Fig. 10 is a block diagram illustrating the functional 
configuration of a bid-opening device in a third em- 
bodiment of the present invention which is designed 
to determine the highest price bid as the winning 
bid; 

Fig. 11 is a flowchart showing the bid-opening pro- 
cedure of the bid-opening device depicted in Fig. 
10; 

Fig. 12 is a block diagram illustrating the functional 
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configuration of a bidding device in a fourth embod- 
iment of the present invention; 
Fig. 13 is a block diagram illustrating the functional 
configuration of a bid-opening device in the fourth 
embodiment; 

Fig. 14 is a flowchart showing the bid-opening pro- 
cedure of the bid-opening device depicted in Fig. 
13; 

Fig. 15 is a block diagram illustrating the functional 
configuration of a bidding device in a fifth embodi- 
ment of the present invention; 
Fig. 16 is a flowchart showing the bidding procedure 
of the bidding device depicted in Fig. 15; 
Fig. 17 is a block diagram illustrating the functional 
configuration of a bid-opening device in a fifth em- 
bodiment of the present invention; 
Fig. 18 is a flowchart showing the bid-opening pro- 
cedure of the bid-opening device depicted in Fig. 
17; 

Fig. 19 is a flowchart showing the bid-opening pro- 
cedure in a modified form of the fifth embodiment; 
Fig. 20 is a block diagram illustrating the functional 
configuration of a bidding device in a sixth embod- 
iment of the present invention; 
Fig. 21 is a flowchart showing the bidding procedure 
of the bidding device depicted in Fig. 20; 
Fig. 22 is a block diagram illustrating the functional 
configuration of a bid-opening device in the sixth 
embodiment; 

Fig. 23 is a flowchart showing the bid-opening pro- 
cedure of the bid-opening device depicted in Fig. 
22; 

Fig. 24 is a flowchart showing a modified form of the 
bid-opening procedure depicted in Fig. 23; 
Fig. 25 is a block diagram illustrating the functional 
configuration of a bidding device in a seventh em- 
bodiment of the present invention; 
Fig. 26 is a flowchart showing the bidding procedure 
of the bidding device depicted in Fig. 25; 
Fig. 27 is a block diagram illustrating the functional 
configuration of a bid-opening device in the seventh 
embodiment; 

Fig. 28 is a flowchart showing the bid-opening pro- 
cedure of the bid-opening device depicted in Fig. 
27; 

Fig. 29 is a flowchart showing a modified form of the 
bid-opening procedure depicted in Fig. 28; 
Fig. 30 is a block diagram illustrating the functional 
configuration of a bidding device in an eighth em- 
bodiment of the present invention; 
Fig. 31 is a block diagram illustrating the functional 
configuration of a bidOopening device in the eighth 
embodiment; 

Fig. 32 is a flowchart showing the bid-opening pro- 
cedure of the bid-opening device depicted in Fig. 
31; 

Fig. 33 is a block diagram illustrating an electronic 
sealed-bit auction system which utilizes a provision- 



al identifier; and 

Fig. 34 is a flowchart showing the bidding procedure 
in the system depicted in Fig. 33. 

5 DETAILED DESCRIPTION OF THE PREFERRED 
EMBODIMENTS 

First Embodiment 

io [0011] The electronic competitive sealed-bid auction 
system according to this embodiment comprises, as is 
the case with Fig. 1 , M bidding devices 10-, to 10 M and 
a bid-opening device 21, which are accessible to each 
other. This system operates as depicted in the flowchart 

is of Fig. 2. 

[0012] Step S1: Input a notice of auction to each of 
the bidding devices 10 1 to 10 M . The notice of auction 
describes bidding conditions such as the name of an ob- 
ject for auction, the highest and/or lowest price bid, the 

20 term for bidding and qualifications for bidding, and a 
method of access to the bid-opening device. The bid- 
ding conditions differ with objects for auction. 
[0013] Step S2: In response to the notice of auction 
which describes the details of the auction, each bidding 

25 device 10 m (where m = 1 , 2, .... M) generates a bidding 
price, and sends to the bid-opening device 20 the bid- 
ding price PR m and an identifier ID m by which the bid- 
ding device 10 m can be identified. 
[0014] Step S3: Having received from the respective 

30 bidding device 10 1 to 10 M their bidding prices PR 1 to 
PR M and identifiers ID, to ID M , the bid-opening device 
20 computes the highest (or lowest) one of the bidding 
prices and determines it to be the winning bid. 
[0015] Step S4: The bid-opening device 20 outputs 

35 the winning bid and the identifier of the bidding device 
having submitted it. 

[001 6] The above procedure is the same as in the pri- 
or art. Since the communication channel between each 
bidding device 10 m and the bid-opening device 20 is not 

40 an anonymous channel, in particular, such a procedure 
as shown in Fig. 2 allows each bidding device 10 m to 
learn the bidding prices of the other bidding devices by 
wiretapping. To avoid this, according to the present in- 
vention, each bidding device 10m uses one-way func- 

45 tions to transform the bidding price to bidding price in- 
formation, which is sent to the bid-opening device 20. 
[0017] Referring to Fig. 3, the bidding device 10m 
comprises an input part 11 , an information storage part 
1 2, a control part 1 3 and a bidding price transformer 1 4. 

50 The control part 13 follows a control procedure stored 
in the information storage part 12 to control operations 
of the respective parts. The notice of auction, which de- 
scribes the bidding conditions, is provided in advance 
via a channel to the bidding device 10 m from the bid- 

55 opening device 20 or some other device. In the informa- 
tion storage part 12 there are also stored the identifier 
ID m of this bidding device 10m and an initial value IV m 
which is used for bidding. At the time of bidding, the bid- 
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ding price PR m provided to the input part 11 is fed via 
the control part 1 3 into the bidding price transformer 14. 
The bidding price transformer 14 uses one-way func- 
tions to transform the bidding price PR m to bidding price 
information y m in integral form. The bidding price infor- 
mation y m and the identifier ID m are sent from a trans- 
ceiver (not shown) to the bid-opening device 20 via a 
communication channel. Based on the bidding price in- 
formation from every bidding device 10 m , the bid-open- 
ing device 20 decides the winning bid. 
[0018] In this embodiment, the bidding price trans- 
former 14 is supplied with the initial value IV m read out 
of the information storage part 12 by the control part 13 
and the bidding price PR m , and processes the initial val- 
ue IV m by a one-way function by the number of times 
corresponding to the bidding price PR m as described 
betow. A one-way function is such a function that, given 
a variable x, y(=h(x)) can easily be computed from x, but 
when given y, very high computational complexity is 
needed to compute x such that y=h(x). An output value, 
obtained by processing the initial value I V m with the one- 
way function h by k times like h(...h(h(h(IV m )))...), will 
hereinafter be represented by h^lV^). 
[001 9] A concrete example of the bidding price trans- 
former 14 is depicted in Fig. 4 and its procedure in Fig. 
5. The bidding price transformer 14 comprises a data 
storage part 14S, conversion table memory 15, a one- 
way function h processor 16 and a one-way function g 
processor 17. Incidentally, the examples of the bidding 
device 1 0 m depicted in Figs. 3 and 4 will also be referred 
to in describing second and third embodiments of the 
invention later on, in which case the broken-lined data 
storage part 14S is provided to store the result D m of 
each computation by the one-way function h and the fi- 
nal result C m of computation. A conversion table, which 
is stored in the conversion table memory 15, is con- 
tained as one bidding condition in the notice of auction, 
for instance. Each bidding device 10m reads out the 
conversion table from a bulletin board 25 of the bid- 
opening device 20 which will be described later on with 
reference to Fig. 6. The conversion table is a table on 
which there are shown appropriately-separated K bid- 
ding prices from the lowest to the highest bidding price 

and a series of corresponding indexes k = 1, 2 K. 

Each bidding device 1 0 m selects a desired bidding price 
from the conversion table and uses the corresponding 
index kas a bidding price index k^ In the Fig. 4 example 
the bidding prices corresponding to the indexes k = 1 , 
2, K are arranged to monotonously increase, but by 
arranging them to monotonously decrease, the lowest 
bidding price can be made a winning bid. 
[0020] The one-function h processor is supplied with 
the initial value I V m and the price index ^ correspond- 
ing to the bidding price PR m read out of the conversion 
table memory 15, and repeatedly processes the initial 
value IV ro with the one-way function h by the number of 
times corresponding to the price index l^. As a result, 
h^l V m ) is obtained. The one-way function g processor 



17 further processes the output value h^flV^) with a 
one-way function g to compute y m = gCh^flV^,)), and 
output it as bidding price information. 
[0021] Step S1 : Input the bidding price PR™ and the 
5 initial value I V m . 

[0022] Step S2: Read out of the conversion table 
memory 1 5 the price index ^ corresponding to the bid- 
ding price PR m . 

[0023] Step S3: In the one-way function h processor 
?0 16, set the initial value of a variable t at 0 and the initial 
value I V m as y m , and repeat steps S4 and S5. 
[0024] Step S4: Determine if t is smaller than ^ 
[0025] Step S5: If t < k„,, update y m with the value of 
h(7 m ) at that time, then increment t by one, and return 
15 to step S4. 

[0026] Step S6: When t becomes no longer smaller 
than y m - h km (l V m ), which is processed by the one- 
way function g processor 17 such that y m <~ g(y m ). 
[0027] Step S7: Output, as the bidding price informa- 
20 tion, Y m obtained in step S6. 

BID-Opening Device (Successful Bid: Highest Bidding 
Price Bid) 

25 [0028] Fig. 6 is a block diagram of the bid-opening de- 
vice 20, which comprises a control unit 21 , and a one- 
way function h processor 22, a one-way function g proc- 
essor 23, an adder/subtractor 24, a bulletin board 25, a 
program storage part 275, an information storage part 

30 35 and an update data storage part 36 wh ich are all con- 
nected to the control unit 21 . In the program storage part 
27S there is stored a bid-opening procedure as a pro- 
gram, and the control unit 21 follows the program to con- 
trol operations of the respective parts. The one-way 

35 function h processor 22 and the one-way function g 
processor 23 are series-connected. The parts except 
the bulletin board 25 constitute a winning bid selector 
27. The number of bidding devices are M, and the initial 
value IV m unique to each bidding device 10 m (where m 

40 = 1, 2, .... M) is prestored by some means in the infor- 
mation storage part 35. In the bulletin board 25 there 
are also recorded other bidding conditions including a 
conversion table 25 A; furthermore, verification informa- 
tion and the results of auction to be published are written 

45 in the bulletin board 25. The pieces of information are 
accessible from any external devices as well as from the 
bidding devices. In this case, however, assume that only 
the bid-opening device 20 is allowed to write in the bul- 
letin board 25 (This applies to other embodiments). 

so [0029] In Fig. 7 there is depicted the procedure of op- 
eration of the bid-opening device 20. In this example the 
bidding price corresponding to the largest price index 
l^ is made a successful bid as follows. The index value 
is decremented one by one from the largest index K cor- 

55 responding to the upper limit of the bidding price spec- 
ified in the conversion table; a check is made for the 
presence of the bidding price information y m (where m 
= 1,2, M) corresponding to each index k is present; 
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and when the bidding price information y m correspond- 
ing to the index k is detected for the first time, the de- 
tected bidding price information y m is determined to be 
the winning bid, and m (the bidding device number) at 
that time is computed, with which the bid-opening pro- 
cedure ends. 

[0030] Step SO: The bidding device 1 0 m inputs its bid- 
ding price information y m and identifier iD m (where m = 
1 , 2, M) to the bid-opening device 20. 
[0031] Step S1: The control unit 21 records the bid- 
ding price information y m and the identifier ID m in the 
bulletin board 25 accessible from arbitrary external de- 
vices (the bidding devices 1 0 1 to 10 M and other devices 
which are not bidders). 

[0032] Step S2: To precalculate D m < 1 >, D m < 2 >, ... D m < k > 
such that D m ( k >=h(D rn ( k - 1 )) in the subsequent steps S3 
to S6, the control unit 21 sets the bidding price index 
k<-1 , then reads out ID m from the information storage 
part 35, and substitutes it for D m <°). 
[0033] Step S3: The control un it 2 1 determ ines wheth- 
er k > K. 

[0034] Step S4: If not k > K, process D m < k - 1 > by the 
one-way function h processor 22 to obtain D m ( k ). 
[0035] Step S5: Store D m ( k ) in the update data storage 
part 36. 

[0036] Step S6: Increment k by the adder/subtractor 

24 such thatk<-k+1. 

[0037] Step S7: If k > K in step S3, it means that 
D m 0>=h(D m <0)Hi(IV m ), Q m (^h(D m 0>)=tf(\V m ). t 
D m (K)=h K (IV m ) have all been obtained, then set k «-K. 
[0038] Step S8: Read out Dj^h^l V m ) from the up- 
date data storage part 36 and process it by the one-way 
function g processor 23 to obtain D m W <^g(D m (% 
[0039] Step S9: For m = 1 , 2, .... M, the control unit 21 
makes a check to see if there exists on the bulletin board 

25 the bidding price information y m of the same value as 
D m < k > 

[0040] Step S1 0: If there does not exist on the bulletin 
board 25 the information y m of the same value as D m M t 
the control unit 21 inputs k to the adder/subtractor 24 to 
decrement k by one (i.e., k<- k-1), then returns to step 
S8, and in steps S8 and S9 it makes a check to see if 
there exists on the bulletin board 25 the bidding price 
information y m of the same value as D^^gfh^l V m )) for 
m = 1,2 M. 

[0041] Step S1 1 : If the information y m of the same val- 
ue as D m W is found on the bulletin board 25 in step S9, 
then the control unit 21 regards it as the successful price 
bid and outputs the index k at this time and the bidding 
device identifier ID m corresponding to the information 
y m , with which the procedure ends. 
[0042] As described above, a check is made first for 
a bidding device 10 m having input the bidding price in- 
formation Y m equal to D m ( k >(=g(h k (l V m ))) when the price 
index k is at the upper limit value K; if no such a bidding 
device is found, then a check is made for a bidding de- 
vice 10 m having input the bidding price information y m 
equal to D m ( k ) when the index k is decremented by one, 



i.e. k<-k-1 ; and if no such a bidding device is found, then 
a check is made for a bidding device 10 m having input 
the bidding price information Y m equal to D m W when the 
index is further decremented by one, i.e. k4-k-1. By 

5 making a check, for each decremented value of k, for 
the bidding device 10 m having input the bidding price 
information y m equal to D m ( k >(=g(h k (l V m ))), it is possible 
to find out the price information y m corresponding to the 
largest index k, that is, the highest bidding price PF^. 

io [0043] Furthermore, each bidding device 10m sends 
hkm+1 (I V m ) to the bid-opening device 20 in advance, and 
the bid-opening device 20 publishes it on the bulletin 
board 25 and, after determining the successful bidding 
price, publishes on the bulletin board 25 the highest bid- 

15 ding price index k and the identifier I D m of the successful 
bidding device and the verification information h k (IV m ); 
in this instance, since k ought to equal k^, it is possible 
for an arbitrary device, except the bid-opening device 
20, to verify the validity or fairness of the bid-opening 

20 process by processing he published verification infor- 
mation h k (l V m ) with the one-way function h to obtain h k+1 
(I V m ) and making sure that it matches n^^lv^) pub- 
lished prior to the determination of the winning bid. Al- 
ternatively, the verification of the bid-opening procedure 

25 can be made by publishing the verification information 
h k (lV m ) of each bidding device on the bulletin board 25 
in advance and making a check to see if the value, ob- 
tained by processing h^l V m ) published on the bulletin 
board 25 with the one-way function h by (K-k^) times, 

30 matches h k (IV m ). 

[0044] In the case where the lowest price bid is the 
winning bid, the bidding prices corresponding to the 
price indexes k on the conversion table are arranged so 
that they monotonously increase from the lowest value, 

35 as referred to previously. 

[0045] In the embodiment described above, all the 
bidding device 10 1 to 10 M send h^+^IVJ to the bid- 
opening device 20 in advance for verification of the re- 
sults of bid-opening, and the bid-opening device 20 

40 writes it on the bulletin board. It is easy to compute h k+1 
(z) from h k (z) in the computation h k+1 (z)=h(h k (z)) using 
the one-way function, but the computation of h k (z) from 
h k+1 (z) involves too enormous computational complex- 
ity to deal with practically. Accordingly, even if the bid- 

45 ding device publishes in advance h^l V m ) computed us- 
ing an index k^ larger than the bidding price index ^ 
there is no possibility of other devices learning the index 
k,,, unless the bid-opening is performed in terms of the 
index k m . 

50 [0046] The value ky of the verification information h 1 ™ 
(I V m ) may be a value k^k^+A which is obtained by add- 
ing the bidding price index 1^ with a predetermined in- 
teger A equal to or greater than 1 , or a value k^K+A 
which is obtained by adding the maximum index K with 

55 the integer A. In the former case, h^lV^) is processed 
A times with the one-way function h and the resulting 
value is checked for matching the published information 
h^l V m ). In the latter case, h kn, (IV m ) is processed K+A- 
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times with the one-way function h and the resulting 
value is checked for matching the published information 
h^lVJ. 

[0047] In the embodiment described above, the bid- 
ding devices to 10 M each convert the bidding price 
PR to the index k by the conversion table and the initial 
value I V m is processed with the one-way function by the 
number of times corresponding to the index k, but the 
use of the conversion table is not essential to the present 
invention. For example, the index k itself may be the bid- 
ding price, in which case neither of the bidding devices 
the bid-opening device requires the conversion table 
and any one of a series of value k which monotonously 
increase one by one within a predetermined range de- 
fined by the upper and lower limits given as one of the 
conditions for auction is chosen as the bidding price PR. 

SECOND EMBODIMENT 

[0048] In the first embodiment the bid-opening device 
20 must be informed of the initial value I V m of each bid- 
ding device 10 m . In this embodiment, however, the bid- 
opening device 20 requires the bidding device 10 m to 
send D m =h k (IV m ) corresponding to the price index k, 
and hence it does not need the initial value IV m . Since 

the price index k varies one by one such that k= 1, 2 

K, this embodiment utilizes the fact that h k+1 (I V m ) = h(h k 
(IVJ) holds; the bid-opening device 20 verifies the re- 
sponse h k (IV m ) from the bidding device in reply to an 
inquiry k, then computes g(h k (IV m )), and checks it for 
matching the bidding price information y m (where m = 1 , 
2, .... M). 

[0049] A description will be given of the case where 
the highest bid is the successful bid. 
[0050] The bidding device 1 0 m has a configuration in 
which the data storage part 1 4S indicated by the broken 
line in Fig. 4 is added to the bidding price transformer 
14. The bidding device 10 m precomputes D m = h k (IV m ) 
by the one-way function h processor 16 for each value 

k = 1 , 2 K+1 , and stores it in the data storage part 

1 4S. When inquired about kfrom the bid-opening device 
20, the bidding device 10 m reads out of the data storage 
part 1 4S the data h^lVJ corresponding to k and sends 
it as the response D m = h^l V m ) to the bid-opening de- 
vice 20. Furthermore, the bidding device 10 m sends to 
the bid-opening device 20 the data h K+1 (I V m ) as the ver- 
ification information C m , together with the bidding price 
information y m As depicted in Fig. 8, the bid-opening 
device 20 comprises a control unit 21 , a one-way func- 
tion h processor 22, a one-way function g processor 23, 
a subtracter 24, a program storage part 27S and a bul- 
letin board 25 accessible from other devices. On the bul- 
letin board 25 there are published a conversion table 
25A along with conditions for auction. 
[0051] The bid-opening device 20 operates as depict- 
ed in Fig. 9. 

[0052] The bidding devices 1 0 m each send h K+1 (I V m ) 
as the verification information C m in advance to the bid- 



10 

opening device 20 together with the bidding price infor- 
mation Y m and the identifier I D m . The bid-opening device 
20 publishes these pieces of data on the bulletin board 
25. Let it be assumed here that M bids are submitted, 

5 and hence m = 1, 2, M. 

[0053] Step S1 : Write and hence publish on the bul- 
letin board 25 the plural pieces of data sent to the bid- 
opening device 20, that is, the bidding price information 
Ym( = 9( nkrn ( ,v m)))» tne verification information C m and 

10 the identifier ID m . 

[0054] Step S2: Set the initial value of the index k at 
the upper limit value K by control unit 21 . 
[0055] Step S3: Request each bidding device 10 m to 
present D m =h k (IV m ). The bidding device 10 m reads out 

is of the data storage part 1 4S the data h k (l V m ), and sends 
it to the bid-opening device 20 as D m . 
[0056] Step S4: Record and hence publish on the bul- 
letin board 25 the data D m sent from every bidding de- 
vice 1 0 m . 

20 [0057] Step S5: Generates h(D m ) for each D m by the 
one-way function h processor 22. 
[0058] Step S6: Make a check to see if all the pieces 
of data h(D m ) match all the pieces of verification infor- 
mation C m on the bulletin board 25; if no mismatch is 

25 found, then determine that they are all correct or valid, 
and continue the subsequent steps. If a mismatch is 
found, then sends an error message to every bidding 
device 10 m and finish the bid-opening operation. 
[0059] Step S7: When no mismatch is found in step 

30 S6, generate data g(D m ) by the one-way function g proc- 
essor 23. 

[0060] Step SB: Make a check to see if each data g 
(D m ) matches the bidding price information y m ; if no 
match is found, update C m on the bulletin board 25 with 
35 D m (C m «-D m ). 

[0061] Step S1 0: Set k<-k-1 by the subtractor 24 and 
return to step S3. 

[0062] Step S1 1 : If even one of the pieces of informa- 
tion y m is found to match with g(D m ) in step S8, decide 
40 k at that time as the price index corresponding to the 
winning bid, and output the index k and the identifier ID m 
of the bidding device 10 m having offered the successful 
bid. 

[0063] In this instance, the values of losing bids other 
45 than the winning one are kept secret from even the bid- 
opening device 20. 

[0064] In this embodiment, too, the lowest price bid 
can be chosen as the winning bid simply by arranging 
the bidding prices in such a manner as to monotonously 
so decrease relative to a monotonously increasing index k 
on the conversion table, or by arranging the bidding pric- 
es in such a manner as to monotonously increase rela- 
tive to a monotonously decreasing index k. 

55 THIRD EMBODIMENT 

[0065] In the second embodiment described above, 
as depicted in Fig. 9, the bid-opening device 20 requires 
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all the bidding devices to present h k (l V m ) and receive it 
for each value of the price index k until the first detection 
of a match between g(D m ) and y m in step S3. Accord- 
ingly, the sealed-bit auction scheme according to the 
second embodiment has the defect of a large commu- 
nication cost. This embodiment requires the bid-open- 
ing device 20 to be informed of nothing but the initial 
value IV m , publishes only the winning bid, that is, hides 
the losing bids, and reduces the communication cost. 
[0066] The bidding device 1 0 m is identical in construc- 
tion as in the second embodiment, and in the construc- 
tions of figs. 3 and 4 the data storage part 14S is pro- 
vided in which there are prestored D m < 1 >, .... D m M and 
C m = D m < k+1 >. The bid-opening device 20, shown in Fig. 
10, is basically identical in construction with the bid- 
opening device of Fig. 8, and no description will be re- 
peated, but as will be described below with reference to 
Fig. 11 , the operation of the bid-opening device in this 
embodiment differs from the operation depicted in Fig. 
9. 

[0067] Step SO: The bidding devices 1 0 1 to 1 0 M each 
send in advance the verification information C m (= h k+1 
(I V m )) to the bid-opening device 20 together with the bid- 
ding price information y m ( =g(h km (IV m )) and the identi- 
fiers ID m . 

[0068] Step S1 : The bid-opening device 20 first pub- 
lishes the plural pieces of bidding price information y m 
and verification information C m and the identifiers ID m 
on the bulletin board 25. 

[0069] Step S2: Set the count value k of a counter 24 
at the upper limit value K. 

[0070] Step S3: Inquire of all the bidding devices 1 0 m 
(where m = 1 , 2, .... M) about whether they have bid the 
price k. 

[0071] Step S4: Decide whether there is bidding de- 
vice having bid with the price index k. 
[0072] Step S5: If no bidding device have bid the 
price, decrement k by the subtracter 24 to k<-k-1 and 
return to step S3. 

[0073] Step S6: When it is found that any one of the 
bidding devices 10 m has bid with the price index k, re- 
quest all the bidding devices 10m to present h^lv^). 
Each bidding device 10 m reads out of the data storage 
part 14S the data D m = h^lv^) precalculated corre- 
sponding to k as depicted in Fig. 4, and sends the read- 
out data D m to the bid-opening device 20. 
[0074] Step S7: Publishes all the responses D m from 
the bidding devices 1 0 m on the bulletin board 25. 
[0075] Step S8: For all the responses D m> generate 
h K ' k+1 (D m ) by the one-way function h processor 22. 
[0076] Step S9: Check whether each data h K ~ k+1 (D m ) 
matches the corresponding verification information C m 
on the bulletin board 25. If no mismatch is found, decide 
that the responses Dm are all correct, and proceed to 
the subsequent steps. If a mismatch is found, send an 
error message to each bidding device 10 m and finish 
this bid-opening session for the price index k. 
[0077] Step S10: When no mismatch is found in step 
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S9, generate g(Dj) by the one-way function g processor 
23 for the response Dj (where 15 j^M) from the bidding 
device 10j which has identified itself as having bid with 
the price k. 

s [0078] Step S11: Check whether g(Dj) matches the 
bidding price information ^ of the bidding device 10j on 
the bulletin board 25. If they match, decide that the bid- 
ding device 10j has bid the price k. If they do not match, 
send an error message to all the bidding devices and 

10 discontinue the session. 

[0079] As described above, in this embodiment, when 
no bidding device identifies itself as having bid the price 
k in reply to the inquiry in step S3, the bidding devices 
10 m are not required to send D m (= h k (IV ra )) to the bid- 

15 opening device 20, and hence the communication cost 
is small as compared with that in the second embodi- 
ment accordingly. 

[0080] As described below, a check is made, if nec- 
essary, to see if another bidding device 10m (different 

20 from the device 10j) has bid a value higher than k. 
[0081] Step S1 2: For t such that fc£t<K and all m's ex- 
cept j (1£m^M, m^), it is checked whether g(h ,_k (h k 
(I V m ))) matches the bidding price information y m on the 
bulletin board 25 for t = k, k+1, .... K, and if a match is 

25 found, then send an error message to each bidding de- 
vice concerned and discontinue the bid-opening ses- 
sion. 

[0082] Step S1 3: If no match is found, then output the 
winning bidding price k and the identifier I Dj of the bid- 

30 ding device having offered the winning bid. 

[0083] With this check or verification, if a bidding de- 
vice makes a false response to the inquiry about wheth- 
er it has bid, for example, with k, this dishonest bidding 
device is detected; that is, this embodiment satisfies the 

35 "undeniability - requirement. When this checking does 
not takes place, the bid-opening device 20 outputs kand 
IDj when deciding in step S1 1 that the bidding device 1 0j 
has bid with k. 

[0084] In this way, this embodiment keeps losing bids, 
40 except the winning one, secret from even the bid-open- 
ing device 20 and reduces the communication cost. 
[0085] While in the above the highest price bid is the 
winning bid, the lowest price bid can be chosen as the 
successful bid simply by arranging monotonously de- 
45 creasing (or increasing) values of the bidding price PR 
on the conversion table in a one-to-one correspondence 
with monotonously increasing (or decreasing) values of 
the price index k. 



[0086] This embodiment is intended to permit simpli- 
fication of the processing in the bid-opening device 20 
and reduction of the communication cost. 
55 [0087] As depicted in Fig. 12, each bidding device 
10 m has a construction in which a random generator 18 
and an operation part 1 9 are added to the bidding device 
shown in Figs. 3 and 4. The random generator 18 gen- 
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erates a random number known only to the bidding 
device 10 m . The operation part 19 uses the random 
number R m and the bidding price PR m to perform a pre- 
determined operation such as a bit concatenation, ex- 
clusive ORing, addition, or multiplication (which opera- 
tion will hereinafter be denoted by (+)), then processes 
the operation result with the one-way function h, and 
sends the processed output h(PR m (+) R m ) to the bid- 
opening device 20, together with the bidding price infor- 
mation y m = QVri^iWm)) and the identifier ID m . 
[0088] Fig. 13 illustrates in block form the functional 
configuration of the bid-opening device 20 in this em- 
bodiment, and Fig. 14 is a flowchart for explaining its 
operation. The bid-opening device 20 has a construction 
in which one-way function h processors 22' and 22" and 
an operation part 26 are added to the device of Fig. 10 
and a subtractor 37 is replaced for the counter 24. For 
simplicity sake, the program storage part 27S is not 
shown. At the time of bidding every bidding device 10 m 
(where m = 1, 2, .... M) sends h K+1 (I V ra ) to the bid-open- 
ing device 20, along with the bidding price information 
7m (= 9( nkm ( ,v m)))» tne identifier ID m and the random 
number information h(PR m (+) R m ). 
[0089] Step S1 : Receive y m , CJ^i (I V ra )). h(PR m 
(+) R m ) and ID m from each bidding device 20 and write 
and hence publish them on the bulletin board 25. 
[0090] Step S2: Request all the bidding devices 10 m 
to present their bidding prices Pf^ and random num- 
bers R m . 

[0091] Step S3: Upon receiving PR,,, and R m from 
each bidding device 10m, compute (PR m (+)R m ) in the 
operation part 26, then compute h(PR m (+)R m ) by the 
one-way function h processor 22", and make a check to 
determine whether the value matches h(PR m (+)R m ) 
published on the bulletin board 25. 
[0092] Step S4: At this point the bid-opening device 
20 learns all the bidding prices. The bid-opening device 
20 obtains from the conversion table 25A a price index 
k^ corresponding to the highest value among the bid- 
ding prices PR^ The bidding device (the successful bid- 
ding device) which has bid k^ will hereinafter be iden- 
tified by 10j. At this point each bidding device cannot 
learn the bidding prices of the other bidding devices. 
[0093] Step S5: Send k mx to all the bidding devices 
10 m and request them to present D m = h kmx (IV m ). 
[0094] Step S6: Each bidding device 10m reads out 
D m - h kmx (l V m ) corresponding to k^ from the data stor- 
age part 1 4S described previously with respect to Fig. 
4, and sends the read-out Dm to the bid-opening device 
20, which writes on the bulletin board 25 all the pieces 
of data D m sent from the bidding devices 10 m . 
[0095] Step S7: For each Dm, calculates K+1 -k^ by 
a subtractor 37 and generate h K+1krnx (D m ) by the one- 
way function h processor 22 from K+1-k^ and D m . 
[0096] Step S8: Verify whether h K+1kmx (D) matches 
the corresponding verification information C m on the 
bulletin board 25. If no mismatch is found, decides that 
all the responses Dm are correct, and proceed to the 
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subsequent steps. If a mismatch is found, sends an error 
message to each bidding device and discontinue further 
operation. 

[0097] Step S9: If no mismatch is found in step S8, 
5 generate g(Dj) by the one-way function g processor 23 
for Dj presented by the successful bidding device 10j. 
[0098] Step S10: Verify whether g(Dj) matches the 
bidding price information 7] in the bidding data of the bid- 
ding device 20j on the bulletin board 25. If they match, 
10 decide that the bidding device 1 0j has bid with the price 
index k^. If they do not match, send an error message 
to each bidding device and discontinue the current bid- 
opening session. 

[0099] As described below, a check is made, if nec- 
15 essary, to see if another bidding device 10m (different 
from the device 10j) has bid a value higher than k^. 
[0100] StepS11: For t = k^ + 1, k^ +2, . ... K, com- 
pute h^ kmx (D m ) by the one-way function processor 22' 
and process the computed result by the one-way func- 
20 tion g processor 23 to obtain gfh^^tDn,)), and verify 
whether this g(h ,-kmx (D m )) matches the bidding price in- 
formation y m on the bulletin board 25 for all m's except 
j(1<m<M, m*j). 

[0101] Step S12: If a match is found, then send an 

25 error message to each bidding device concerned and 
discontinue the current bid-opening session. If no match 
found, then output the winning bidding price index k^ 
and the identifier ID, of the bidding device 10j having of- 
fered the winning bid. 

30 [01 02] For example, in the case where the bidding de- 
vice 10m bids with the random number information h 
(PR m (+)R m ) and the bidding price information y m = g 
(h^l V m ) (where PR m '>PR m ) and presents a price PR^/ 
higher than the bidding price PR^ and the random 

35 number R m in reply to the request for the presentation 
of PR m and in step S2 and the price PF^' becomes 
the highest bid value, if the bidding device presents D m 
= h kmx (l V m ) in reply to the request for the presentation 
of h kmx (IV m ) in step S5, it will pass the verifications in 

40 steps S7 and S8, incurring the possibility that the price 
PR m lower than PR m ' becomes the winning bid. Howev- 
er, this can be prevented because a mismatch is found 
between g(D m ) = g(h^(IVJ) and Ym = g(h»™(IVJ in 
steps S10 and S11. 

45 [0103] With the bid-opening device 20, it is possible 
to specify the winning bid and the corresponding suc- 
cessful bidding device from PR m , R m and I D m with ease, 
reduce the communication cost and verify that the win- 
ning bidding price and the winning device determined 

50 from PR m , R m and I D m are true. 

FIFTH EMBODIMENT 

[01 04] In this embodiment each bidding device sends 
55 to the bid-opening device bidding price information con- 
taining select information which indicates whether to bid 
for each of K kinds of biddable prices. As depicted in 
Fig. 15, the bidding price transformer 14 of the bidding 
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device 10m comprises a control part 41 , a random gen- 
erator 42, a one-way function h processor 43, a select 
information generator 45, a (+) operation part 46 and an 
adder 47. 

[0105] Let PR m represent that one of the K kinds of 
price indexes 1, 2, .... K which the bidding device 10 m 
is to actually to bid. The select information denoted by 
b m M is defined as follows: b m < k > = 0 when the bidding 
device 10 m does not bid for the price index k such that 
1^k^K, and b m ( k ) = 1 when the bidding device 10 m bids 
for the price index k. Accordingly, only one piece of in- 
formation b m < k ) exists for k such that 1£k£K. As men- 
tioned above, the two values of the information b m < k ) 
may be any values as long as they differ from each other. 
The information b m W is known only to the bidding device 
10 m , which uses it as a random number for each value 
of the price index k. The bidding device 10 m outputs 
{ID m , h(1( + )b m 0)( + )R m 0)) ) h(2( + )b m (2)( + )R m (2)), .... h(K 
(+)b m ( K )(+)R m ( K >} as bidding price information. 
[0106] A description will be given, with reference to 
Fig. 16, of the procedure by which K pieces of bidding 
price information are prepared. 
[0107] Step S1 : The bidding price PR m is determined 
and input. 

[01 08] Step S2: Set the initial value of the price index 
ktol. 

[0109] Step S3: Make a check to see if k^K. 
[0110] Step S4: If k^K, generate the random number 
R m ( k ) by the random generator 42. 
[0111] Step S5: Generate the rice select information 
b m W by the select information generator 45 in accord- 
ance with the bidding price PF^. 
[01 1 2] Step S6: The (+) operation part 46 inputs there- 
into these pieces of information R^k) and b m ( k ), and 
compute k(+)b m 0O(+)R m ( k ). (+) indicates a predeter- 
mined appropriate operation, which may be a concate- 
nation, addition, subtraction, multiplication, or the like. 
[0113] StepS7: Process the result of this operation by 
the one-way function h processor 43 to generate h(k(+) 

bJ»(+)F\„»). 

[0114] Step S8: Increment k by one by the adder 47, 
followed by a return to step S3. 
[0115] Step S9: When k exceeds K and the process- 
ing for all values of k ends, the bidding device 1 0 m sends 
the identifier ID m and the bidding price information {h(1 
( + )b m 0>( + )R m O>), .... hlKf+^WF^tK))} to the bid- 
opening device 20. 

[011 6] By generating the bidding price information for 
each price through utilization of the one-way function 
and sending all the pieces of bidding price information 
to the bid-opening device 20 as described above, the 
aimed bidding price can be kept secret. 
[0117] Fig. 17 illustrates in block form the bid-opening 
device 20 which performs the bid-opening process 
based on such bidding price information sent thereto. 
The bid-opening device 20 comprises a control part 21 , 
a one-way function h processor 22, a subtractor 24, an 
information storage part 35, a bulletin board 25 and a 
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(+) operation part 51. As is the case with Fig. 8, the pro- 
gram storage part 27S is also provided but is not shown 
for the sake of brevity. 

[011 8] Fig. 1 8 is a flowchart for explaining the opera- 

5 tion of this bid-opening device 20. 

[01 1 9] Step SO: Receive the bidding price information 
{ID m , h(1( + )b m 0)( + )R m 0)), h(2( + )b m (2)( + )R m (2)), .... h(K 
(+)b m ( K )(+)R fn ( K ))} from the bidding device 10 m (where 
m = 1, 2, M). 

10 [0120] Step S1 : Write and hence publish the bidding 
price information on the bulletin board 25. 
[0121] StepS2: Set the price index k to its highest val- 
ue K. 

[0122] Step S3: Request each bidding device 10 m to 
15 present the random number R m M 

[0123] Step S4: The bidding devices 10 m each send 
the random number F^M to the bid-opening device 20, 
which writes all the random numbers R^M on the bul- 
letin board 25. 

20 [0124] Step S5: Set b m < k ) = 1, then input b m < k > and 
R m W to the (+) operation part 51 to perform an operation 
k(+) 1 (+)R m M, and process the result of operation by the 
one-way function h processor 22 to obtain h(k(+)1(+) 

25 [01 25] Step S6: For each m, make a check to see if a 
match is found between the calculated h(k(+)1 (+)R m W) 
and hfkf+W+lF^W) on the bulletin board 25. 
[0126] Step S7: If no match is found, decrement k 
such that k<-k-1 , and return to step S3. 

30 [0127] Step S8: If a match is found, determine the k 
as the successful price index k, then output the price 
index k and the identifier ID m of the bidding device 10 m 
concerned, and discontinue the current bidopening 
session. 

35 [01 28] As described above, according to this embod- 
iment, the bidding price information corresponding to 
each price index is generated using the one-way func- 
tion and all the pieces of bidding price information are 
sequentially opened in decreasing order from the high- 

40 est value. This enables non-winning bids to be kept se- 
cret. 

[01 29] In the case of choosing the lowest price bid as 
the successful bid in this embodiment, the bidding de- 
vice 10 m similarly sends the bidding price information 

45 { |D m , h(1( + )b m 0)( + )R m 0>), h(2( + )b m (2) (+)Rm (2 ))> _ n(K 
(+)b m < K )(+)R m < K >)} to the bid-opening device 20. The bid- 
' opening device 20 carries out about the same process- 
ing as depicted in Fig. 1 8, but in step S2 the lowest value 
1 of the K kinds of biddable price indexes is set to k and 

50 jp sep S6 the index k is incremented by one such that 
k*-k+1. 

[0130] In the case of choosing the highest price bid 
as the winning bid in this embodiment, since random 
numbers R m (*) received from all the bidding devices for 
55 t (where k^KK) are recorded on the bulletin board 25 in 
step S4, it is possible to detect that b m ( k ) = 0 for the index 
larger than the winning price index k, by calculating h(t 
( + )b m <0( + )R m (t>) and comparing it with h(k(+)b m ( k >(+) 
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R m ( k )) published on the bulletin board 25. Accordingly, 
any one can determine if the winning price index k is 
correct. 

[0131] In this embodiment it is also possible for each 
bidding device 1 0 m to send the set of random numbers s 
{ R m (k) } (k=L ,K) to the bid-opening device 20 in ad- 
vance together with ID m and h(k(+)b m ( k )(+)R m ( k )). In this 
case, however, the random number R m < k ) is not written 
on the bulletin board 25 but is stored in the broken-lined 
information storage part 35. In Fig. 19 there is shown a 10 
flowchart for explaining the processing which the bid- 
opening device 20 performs in such an instance. 
[01 32] Sep SO: Receive the bidding price information 
{ID m , hOWbJlJWRjD, h(2( + )b m (2)( + )R m (2), .... h(K 
(+)b m ( K )(+)R m < K ))} and random number information 1$ 

{R m 0), RJ 2 ) R m (K)} from the bidding devices 10 m 

(where m = 1, 2, .... M). 

[01 33] Step St : Write and hence publish only the bid- 
ding price information on the bulletin board 25 and store 
the random number information in the storage part 35 20 
indicated by the broken line. 

[0134] Step S2: Set the highest possible value K for 
the price index k. 

[0135] Step S3: For all m's, generate h(k(+)1 (+)R m < k >) 
read out of the storage part 3 5 with b^M . 25 
[0136] Step S4: Verify whether a match is found be- 
tween h(k(+)1 (+)R m (k) ) and the pieces of bidding rice in- 
formation written on the bulletin board 25. 
[0137] Step S5: If no match is found, decrement the 
price index k by one to k^k-1 and return to step S3. 30 
[0138] Step S6: For the index k for which the mach 
was found, write and publish all the random numbers 
RJ*) (k<t^<) on the bulletin board 25. 
[0139] Step S7: Determine k at this time as the win- 
ning price index, then output this index k and the iden- 35 
tifier ID m of the bidding device 10 m having submitted the 
winning bid, and discontinue the current bid-opening 
session. 

[01 40] When the lowest bidding price bid is chosen as 
the successful bid in this case, the index k is set to the 40 
smallest possible value, 1 in this example, in step S2 in 
Fig. 1 9, then in step S4 the index k is incremented by 
one, and in step S5 all random numbers R^ 1 ) which are 
1<t<k are published on the bulletin board 25. The other 
operations are the same as those described above with 45 
reference to Fig. 19. 

[0141] While in the above the select information b m ( k ) 
has been described to be "0" or "1," they may be any 
values as long as they are two predetermined different 
integers. so 

SIXTH EMBODIMENT 

[0142] In the second embodiment described previ- 
ously,- at the time of bidding each bidding device 10 m ss 
sends the bidding price information y m = gfh^fl V m )) and 
the verification information C m = h k+1 (IV m ) to the bid- 
opening device 20, and at the time of bid-opening the 
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bid-opening device 20 requests the bidding device 10 m 
to send the information D m = h k (IV m )„ and verifies 
whether h(D m ) and C m match for the information D m re- 
ceived from the bidding device 10 m ; if they match, then 
the bid-opening device 20 further verifies whether g(D m ) 
matches the bidding price information y m . These verifi- 
cations need to be made for all of m = 1, 2, .... M. Ac- 
cordingly, the amount of data to be processed increases 
with an increase in the number M of bidding devices 
used. In addition, the larger the highest value K of the 
index k, the more the amount of multiple processing by 
the one-way function h; hence it is necessary to process 
an enormous amount of data. 

[0143] To avoid this, the sixth embodiment utilizes 
one-way functions to transform the bidding price index 
k^ to gm=H m ( K >= h K - km )g xm (IV ra )), which is sent to the 
bid-opening device 20. is an arbitrary integer equal 
to or greater than 1 which is determined by the bidding 
device 1 0 m . When inquired about whether it has bid with 
the index k, the bidding device 10 m presents H ro < k " 1 > = 
h k " km-1 (g xm (IV m )) if k is not its aimed bidding price index 
k^, and if it is the aimed value, the bidding device 10 m 
presents H m ( k " 1 ) = g xm " 1 (IV m ). The bid-opening device 
20 verifies the former with h(H m ( k1 )) = H m (K) and the lat- 
ter with g(H m < k -D) = H m (»<). 

[0144] The M bidding devices 10 m indirectly bit the 
bidding price index values k^ to the bid-opening device 
20, which detects the largest one of the index values k^ 
bit by the bidding devices 10 m . Each bidding device 10 m 
and the bid-opening device 20 have a conversion table 
in which K bidding prices PR^ PR2, .... PRk are held in 
a one-to-one correspondence with K kinds of index val- 
ues 1, 2, K in increasing order. In this embodiment, 

as the index value k (where k = 1 , 2 K) increases, 

the value PR k becomes larger; for example, PF^ = 10, 

PR 2 = 15, PR3 = 30 PR K = 3000. 

[0145] Fig. 20 illustrates in block form the functional 
configuration of the bidding device 10 m and Fig. 21 is a 
flowchart showing its bidding procedure. The bidding 
device 10 m comprises an input part 11, a control part 
1 3, a bidding price transformer 14, a transceiver 18 and 
a storage part 12 all of which are interconnected via a 
common bust 0B. The bidding price transformer 14 is 
made up of a conversion table 15, a one-way function 
h processor 1 6 and a one-way function g processor 1 7. 
The control part 13 reads out a bidding procedure pro- 
gram stored in the storage part 12, and follows it to con- 
trol the respective parts to perform bidding as described 
below. 

[0146] Step S1 : The bidding device 10 m receives via 
the input part 11 a value PR m selected from values PR 1t 
PR2 PF^, an initial value (a positive integer) I V m and 
an arbitrary integer x m equal to or greater than 1 . 
[0147] Step S2: The control part 1 3 stores I V m and x m 
in the storage part 1 2. 

[01 48] Step S3: The control part 1 3 refers to the con- 
version table 1 5 with PR m to convert it to an index value 
k^ and stores it in the storage part 1 2. 
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[0149] Step S4: The initial value IV m and the bidding 
price x m are read out from the storage part 1 2, then input 
to the one-way function g processor 17, wherein the in- 
itial value is processed x m times with the one-say func- 
tion g to obtain g* m (IV m ). s 
[01 50] Step S5: If necessary, g^l V m ) is stored in the 
storage part 12. 

[0151] Step S6: g^lVJ, K and ^ are input to the 
one-way function h processor 16, wherein g^OVn,) is 
processed K-l^ times with the one-way function h to ob- io 
tain 

H m (K) = h Kkm (g xm (IVJ). 

15 

[0152] Step S7: H m < K > is sent as the bidding price in- 
formation to the bid-opening device 20 via the transceiv- 
er 18. 

[0153] In this way, the bidding device 10 m sends the 
aimed bidding price index value l^ to the bid-opening 20 
device 20. 

[0154] Step S8: Upon beginning the bid-opening pro- 
cedure by the bid-opening device 20 after the bidding, 
each bidding device 10 m receives an inquiry with the 
price index k from the bit-opening device 20 by the trans- 25 
ceiver 18 as depicted in Fig. 21. 
[0155] Step S9: A check is made to see if the inquiry 
index value k is equal to the bidding price index ^ 
stored in the storage part 12. 

[0156] Step S1 0: If not equal, g*"»(l VJ is read out of 30 
the information storage part 12 and is input to the one- 
way function h processor 16 together with and k, 
wherein g xm (IV m ) is processed k-k^-1 times with the 
one-way function h to obtain response information 
H m ( k ~ 1 > by the fol towing equation: 35 

[0157] Step S11: The bidding device 10 m sends the 40 
response information H m ( k1 ) to the bid-opening device 
20 via the transceiver 18 and waits for the next inquiry 
about k. 

[01 58] Step S12: If the inquiry about k corresponds to 
its aimed value, that is, if the index k is equal to k^ in he 45 
storage part 12, the bidding device 10 m inputs the initial 
value I V m and x m . 1 to the one-way function g processor 
17, wherein the initial value IV m is processed xm-1 times 
to obtain response information H m ( k_1 ) = g^'^IV^,). 
[0159] Step S13: The bidding device 10 m sends the so 
response information H^ -1 ) to the bid-opening device 
20. 

[01 60] The functional configuration of the bid-opening 
device 20 is depicted in Fig. 22 and its bid-opening pro- 
cedure in Fig. 23. The bid-opening device 20 comprises ss 
a control part 21 , a program storage part 275, a one- 
way function h processor 22, a one-way function g proc- 
essor 23, a counter 24, a bulletin board 25, a conversion 



table 25A, a transceiver 28, and an information storage 
part 25, all of which are interconnected via a common 
bus 20B. 

[0161] Step S1 : Upon receiving the bidding informa- 
tion Tm =H m W from each bidding device 10 m by the 
transceiver 28, the control part 21 writes the bidding in- 
formation H m QQ on the bulletin board 25 to publish it. 
[0162] Step S2: Set K as the initial value of k in the 
counter 24. 

[0163] Step S3: Send the index value k on the counter 
24 to each bidding device 10 m> and send thereto an in- 
quiry about bidding via the transceiver 28. 
[0164] Step S4: Receive the response information 
H^- 1 ) by the transceiver 28 from all the bidding devices 
10 m - 

[0165] Step S5: Input H m ( k " 1 ) to the one-way function 
h processor 22 to process it with the one-way function 
h to obtain h(H m 0<-i>). 

[01 66] Step S6: Check whether the result of operation 
tifFU^" 1 *) is equal to the bidding information A,,, for m in 
the storage part 35. 

[0167] Step S7: If h(H m < k -i>) = H m 0O, store the re- 
ceived information H m ( k1 ) as updated bidding informa- 
tion H^K) in the storage part 35 to update HJM. 
[0168] Step S8: Decrement the count value k of the 
counter 24 by one, then return to step S3, and inquire 
of each bidding device 10 m about whether it has made 
a registration for the value k. 

[0169] Step S9: When it is found in step S6 that the 
response information H m < k_1 ) from the bidding device 
10 m is g^'M'Vm) which is equal to the aimed index val- 
ue, h(H m ( k " 1 >) does not become equal to H^*) = 

h ek + 1-km-1 (g xm (|Vm)) _ gxm(| Vm ) jn step 59 j nput 

Hn,^ -1 ) to the one-way function g processor 23 to proc- 
ess H m ( k l ) with the one-way function g to obtain g 

[0170] Step S10: Make a check to see if g(H m 0<- 1 >) is 
equal to corresponding to m stored in the storage 
part 35. 

[0171] Step S11: When the bidding device 10 m has 
performed correct processing, h km+1krn - 1 (g xm (IV m )) = 
QF m (\V m ) = H m (K) by the process of step S7 at the time 
of previous inquiry for k= k^ ; hence, gfH^* 1 )) = H m W 
holds. In the inquiry processing for the index k which is 
decremented one by one, the index k for which g 
(H^ -1 )) = H m ( K ) holds for the first time is the maximum 
value among the bidding price indexes of all the bidding 
devices, and this index k is converted to the value PF^ 
by referring to the conversion table 25A. 
[0172] Step S1 2: Output the value PR k as the highest 
one of the bid values, and if necessary, output the 
number m of the winning bidding device 10 m as well. 
[01 73] In the bidding procedure of Fig. 21 , if k = k^ in 
step S9 when inquired about whether it has bid k, the 
bidding device 10 m may send to the bid-opening device 
29 in step S1 3 not only the -response information H ra < k_1 ) 
but also information indicating k = l^ (which information 
will hereinafter be referred to as identity information). In 
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this instance, upon receiving the response information 
H m (k1) in ste P S4 in F '9- 23 - tne bidopening device 20 
makes a check for the identity information; if not having 
received it, the device 20 performs the operation h 
( H m (k1) ) and if having received the information, g 
( H m (k ~ 1) )- Incidentally, in the event that g(H ra (k- 1 ))# H m (K) 
in step S10 in Fig. 23, the bid-opening device 20 may 
discontinue the current bid-opening session for the rea- 
sons of dishonesty by the bidding device concerned and 
request all the bidding devices 10 m to rebid; alternative- 
ly, the bid-opening device 20 may abandon inquiringthat 
bidding device but may continue inquiring the other bid- 
ding device. 

[0174] In the case where the bidding prices PF\ are 
arranged on each of the conversion tables 15 and 25A 
in such a decreasing order as 3000, 2950, 2900, .... 100 
in correspondence with the K index values 1, 2, .... K, 
the price PR k corresponding to the index value k for 
which g(H m ( k - 1 )) = holds for the first time in the 
inquiry about bidding k represents the lowest one of the 
aimed bidding prices of all the bidding devices 1 0 m . The 
maximum value of the index may also be obtained with- 
out using the conversion table 15. In this instance, the 
bidding device 1 0 m sends the index value k^ and after 
step S10 in Fig. 23 the bid-opening device 20 outputs 
the index value kas the highest value and, if necessary, 
together with the number m (or ID m ) of the bidding de- 
vice 10 m having sent the index value l^. 
[0175] In the bid-opening procedure depicted in Fig. 
23, the bid-opening device 20 inquires every bidding de- 
vice 10 m for each value of the index k = K, K-1 , K-2, 
and receives H m < k " 1 ), and then processes it using the 
one-say function h in step S5; hence this procedure re- 
quires high communication cost and computational 
complexity. In Fig. 24 there is depicted a modified form 
of the above-mentioned bid-opening procedure whose 
communication cost and computational complexity are 
reduced using the scheme described previously with 
reference to Fig. 11 . No description will be given of the 
bidding procedure since it is exactly the same as in the 
Fig. 11 embodiment. 

[0176] Step SO: Receive bidding price information 
H m W = h K km (g xm (l V m )) and the identifier ID m from each 
bidding device. 

[0177] Step S1: Publish the received H m W and ID m 
on the bulletin board 25. 

[0178] StepS2: Set the initial value of the index kat K. 
[0179] Step S3: Inquire of all the bidding devices 1 0 m 
about whether they bid for the index k. 
[0180] Step S4: Checkthe responses for YES (which 
means that the bidding device concerned has bid for the 
index k). 

[0181] Step S5: If no YES is found, decrement k by 
one and returns to step S3 to repeat the same process- 
ing. 

[01 82] Step S6: If YES is found, request all the bidding 
devices 10 m to send their bidding price information 
H m (k1) - response of the bidding device to this re- 



quest is the same as described previously in connection 
with Fig. 21. 

[0183] Step S7: Publish the received information 
Hjt'V on the bulletin board 25. 
5 [01 84] Step S8: For the response H m ( k1 ) of an m (rep- 
resenting the bidding device 10 ro ) having bid for the in- 
dex k, compute 

H n , = h Kk (g(H nl (k - 1 >). 

and for the responses H m ( k1 ) from the other m's (the 
other bidding devices), compute 



[0185] Step S9: Check whether H m = H m W holds for 
all the m's, and if a mismatch is detected for even one 
of them, send an error message to all the bidding devic- 
es and discontinue the current bid-opening session. 
[0186] Step S1 0: If a match is detected for every one 
of them, determine that the bidding device 10 ra of the 
number m having responded YES is the winning bidder, 
and output the index k at that time and its identifier ID m 
for publication 

[0187] The bidding device 10m and the bid-opening 
device 20 can each be implemented by a computer. 

SEVENTH EMBODIMENT 

[0188] In the fifth embodiment described previously, 
each bidding device 10 m generates the select informa- 
tion b m ( R ) indicating whether to bid for every price index 

k = 1 , 2 K, and these pieces of select information are 

contained in K pieces of information h(k(+)b b < k >(+) 
R m W), where k = 1, 2, K. In this embodiment, how- 
ever, the plural pieces of select information are con- 
tained in a single piece of bidding price information 
through multiple processing with the one-way function h. 
[0189] Fig. 25 illustrates in block form the functional 
configuration of each bidding device 10 m . Assume that 
K bidding prices PR and the k price indexes k = 1 , 2, 
K, which have a one-to-one correspondence with each 
other, are both arranged in monotone increasing order 
in the same direction. The bidding select information for 
each index k will be identified as b< k >. In this embodiment 
a select information generating part 54 does not gener- 
ate the select information b m ( k > for all the indexes k = 1 , 
2, .... K but instead generates the select information 
b m ( k ) only for indexes higher than the bidding price index 
H m ( k >- h(H m <M1bJH)-is calculated, with H m 0™-i> = 
IV m as its initial value, for each value of the price index 
k (=1^, k^+1 , .... K) by a one-way function h processor 
16, a concatenator 55 and a buffer 56, and the calcula- 
tion result H m M for each value of k is stored in a data 
storage part 14S. The final calculation result H m M will 
hereinafter be called bidding price information. In this 
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embodiment, a signature Sig m (H m < K )) is generated by a 
signature generator 14S for the bidding price informa- 
tion 57. 

[01 90] Fig. 26 is a flowchart showing the bidding pro- 
cedure of the bidding device 10 m depicted in Fig. 25. 
[0191] In this embodiment, letting k^ be the index that 
the bidding device 10 m bids, a select information gen- 
erating part 54 generates K-k^+l pieces of select infor- 
mation b m ( km >, b m < krn+1 \ b h M corresponding to the 
indexes larger than the bidding price index (step S1 ). 
Then, Hj 1 ™- 1 ), Hj^) h^O""^), .... Hj*) are succes- 
sively generated by the following equations 



H (km ~ 1) = IV m 

m m 

H m (km> = h(H m (k ^ 1) ||b (n <km) ) 
H m (km+1) = h(H m (km) ||b m (,<m+1) 



H„ W = h(H ro n|b m W ) 



and they are stored in the data storage part 14S (step 
S2). Further, a signature a m = Sig^l-^*)) of the bidding 
device 10 m corresponding to the bidding price informa- 
tion H^K) is generated by the signature generator 14S 
(step S3). The bidding device 10 m sends. h m W, a m and 
ID m as bidding information to the bid-opening device 20 
(step S4). After this, the bid-opening procedure is start- 
ed, and upon receiving an inquiry for each value of the 
index k, the bidding device reads out {H m ( k ~ 1 ), b m < k >) from 
the data storage part 14S, and sends it to the bid-open- 
ing device (step S5). 

[0192] The bid-opening device 2- comprises, as de- 
picted in Fig. 27, a control part 21 , a one-way function 
h processor 22, a counter 24, a bulletin board 25, an 
information storage part 35, comparators 58 and 59 and 
a signature verifier 33. The pieces of bidding information 
H m W, o m and ID m are written on the bulletin board 25. 
Then, the received information H m ( k ~ 1 ) is processed by 
the one-way function h processor 22 to obtain H m < k > = h 
(H m ( k ' 1 )), which is compared by the comparator 58 with 
H m ( k > read out of the bulletin board 25 to thereby verify 
whether they match. Further, it is checked by the com- 
parator 59 whether the received select information b m < k > 
is 1, and if it is 1, then the bidding device 10 m corre- 
sponding to m at that time is determined as the winning 
bidder. 

[0193] Fig. 28 is flowchart showing the bid-opening 
procedure of the bidopening device 20. 
[0194] The bid-opening device 20 verifies respective 
signatures a m (where m = 1, 2, .... M) and writes and 



publish the received pieces of information H m ^ t a m and 
ID m on the bulletin board 25. 

[0195] The bid-opening device 20 sends k to the bid- 
ding device in the order [k = K, K-1, K-2, ...] and asks 
5 for information {H m ( k " 1 >, b m < k >} corresponding to each in- 
dex k. The information {H m < k - 1 ), b m ( k )} received from 
each bidding device 10 m is published on the bulletin 
board 25, then it is checked whether H m ( k > = h(Hj k - 1 >, 
b m < k )) holds for the information received previous- 
ly |y, and if it holds, it is checked whether the select infor- 
mation b m M is 1. When b m < k > is 0 for all of m = 1 , 2, 
M, the bid-opening device 20 decrements k to k<-k-1, 
then sends again k to the bidding device and asks for 
the information {H m ( k_1 ) t b m ( k >}, thereafter performing the 
is same operation as described above. - If the select infor- 
mation b m 0<) is 1 for any one of m = 1 , 2, M, then the 
bidding device 10m corresponding to that m is deter- 
mined as the winning bidder. The bid-opening device 20 
publishes the successful bidding price index and the 
20 identifier ID m of the wining bidding device 10 m on the 
bulletin board 25. 

[01 96] According to this embodiment, since each bid- 
ding device does not perform the multiple processing 
with the one-way function for indexes smaller than the 
25 bidding price index k^ the computational complexity is 
low accordingly. 

[0197] The bid-opening device performs the bid- 
opening procedure as described below. 
[0198] Step SO: Receive the pieces of bidding infor- 

30 mation V\J^, o m and ID m from each bidding device, 
then verifies respective signature o m (where m= 1, 2, .... 
M), and writes and publishes the pieces of information 
Hm 0 ^' °m and ID m 00 the bulletin board 25. 
[01 99] Step S1 : Set the initial value of the index k to K. 

35 [0200] Step S2: Send k to each bidding device 1 0 m 
and ask for {H^ -1 ), b m (% 

[0201] Step S3: Write and publish on the bulletin 
board 25 the information {H„/ k - 1 >, b m W} received from 
each bidding device 10 m . 

40 [0202] Step S4: Process the received information 
{H m ( k - 1 >, b^} by the one-way function h processor 22, 
thereby generating H = hfHjPrtlbJH). 
[0203] Step S5: Verify by the comparator 58 whether 
H generated in step S4 matches the previously received 

45 H m W. If a mismatch is detected, then send an error mes- 
sage to the bidding device and discontinue the current 
bid-opening session. 

[0204] Step S6: If no mismatch is found in step S5, 
then decides that the response from every bidding do- 

50 vice is valid, and make a check by the comparator 59 to 
see if the received select information b m 0<) is 1 . 
[0205] Step S7: When the select information b m M 
from all bidding devices 10 m is 0, update k with k-1 and 
return to step S2. 

55 [0206] Step S8: When any one of M pieces of select 
information b m < k ) is 1 in step S6, determine that the bid- 
ding device 10 m corresponding to m, which provides 
that information b m < k ), is the winning bidder, and write 
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and publish its identifier ID m and the index k,< of the win- 
ning bid on the bulletin board 25, and end the bid-open- 
ing procedure. 

[0207] In this embodiment the prices bid by the un- 
successful bidders are each kept secret from the other 
participants. The lowest price bid can be made a suc- 
cessful bid by using a conversion table wherein the price 
PR monotonously increases in the direction opposite to 
that in which the index k monotonously increases. 
[0208] Incidentally, it is also possible to set H m ( 0 > = 

IV m , H m (D = hfHjo^d)) Hm (K) = h(H m <K-i)||b m <K)), 

where b m 0> = b m < 2 ) = ... = b m <»™- 1 > = 0. 
[0209] The communication cost and computational 
complexity involved in the bid-opening procedure of Fig. 
27 can also be reduced, as depicted in Fig. 27', by the 
application of the scheme described previously with ref- 
erence to Fig. 11. The bidding procedure is exactly the 
same as in Fig. 25, and hence it will not be described. 
[021 0] Step SO: Receive the bidding price information 
H m <K) = h(...h(h(H m (^lb m O™))||b ra (^i))^|b m (K)) and 
the identifier ID m from each bidding device. 
[0211] Step S1 : Publish the received Hj*) and ID m . 
[021 2] Sep S2: Set the initial value of the index k at K. 
[021 3] Step S3: Inquire of all the bidding devices 1 0 m 
about whether they bid for the index k. 
[021 4] Step S4: Check the responses for YES (which 
means that the bidding device concerned has bid for the 
index k). 

[0215] Step S5: If no YES is found, decrement k by 
one and returns to step S3 to repeat the same process- 
ing. 

[021 6] Step S6: If YES is found, request all the bidding 
devices 10 m to send their bidding price information 
H m (*-1) = h(...h(h(H m (^1)||bJkm) ) | |bm (km,1) ) ..J| ^(K)). 

The response of the bidding device to this request is the 
same as described previously in connection with Fig. 21 . 
For the bidding device having bid for the current index 
k, k =: !(„,; therefore, H m < k - 1 > = H m < knr '- 1 ) = I V m . 
[0217] Step S7: Publish the received information 
H^ 1 ) on the bulletin board 25. 
[021 8] Step S8: For the response H^ -1 > of an m (rep- 
resenting the bidding device 10 m ) having bid for the in- 
dex k, compute 

H m ^h(...h(h(H m (k - 1) ||1)||0)||...0) 

and for the responses H m ( k " 1 > from the other m's (the 
other bidding devices), compute 

H m = h(...h(h(H m (k - 1) )||0)||0)...||0). 

[0219] Step S9: Check whether H m = H m ( k > holds for 
all the m's, and if a mismatch is detected for even one 
of them, send an error message to all the bidding devic- 
es and discontinue the current bid-opening session. 
[0220] Step S 10: If a match is detected for every one 



of them, determine that the bidding device 10 m of the 
number m having responded YES is the winning bidder, 
and output the index k at that time and its identifier ID m 
for publication. 

5 

EIGHTH EMBODIMENT 

[0221] In each of the embodiments described above, 
the bidding prices for the bidding price indexes k = 1 , 

10 2 K in the conversion table are discrete values such 

as 1000, 2000, 3000, .... 10000, and each bidding de- 
vice bids any one of the K prices but cannot bid a value 
intermediate between such discrete prices unless K 
prices are set in "1 " increments. This embodiment is in- 

is tended to permit bidding an arbitrary price intermediate 
between the discrete values. In this embodiment, an ar- 
bitrary bidding price PR within the range defined by the 
highest and lowest bidding prices is expressed by the 
following equation. 

20 

PR=F(k) + Q 

where: 0 £Q < F(k+1) - F(k) 
25 F(k) represents the price corresponding to the index k 
specified on the conversion table, and Q will hereinafter 
be referred to as a fraction. 

[0222] This embodiment is one that the bidding price 
PR defined above is applied to the first embodiment de- 
30 scribed previously. Bidding price information g(h k (IV m )) 
and Q m are sent to the bid-opening device 20. Further, 
h K+1 (IV m ) is sent as verification information to the bid- 
opening device 20 together with the bidding price infor- 
mation. These pieces of information are published on 
35 the bulletin board as is the case with the first embodi- 
ment. 

[0223] Fig. 30 is a block diagram illustrating the con- 
figuration of each bidding device 10 m , which is identical 
with the bidding device of the first embodiment except 
40 that the bidding price transformer 1 4 is provided with a 
fraction calculating part 14a. The fraction calculating 
part 14A calculates, for a desired bidding price PF^, Q m 
= PR m -F(k m ) from the index k,,, read out of the conver- 
sion table 1 5. As is the case with the first embodiment, 
45 the one-way function h processor 16 and the one-way 
function g processor 1 7 are used to compute y m = gfh 1 "" 
(IV m )) from the index k^ which satisfies F(k m +1) 
>PR m ^F(k m ) and the initial value IV m . In this embodi- 
ment, Y m , Q m and ID m are sent as bidding information 
50 to the bid-opening device 20. 

[0224] The bid-opening device 20 has, as depicted in 
Fig. 31 , a sequencer 61 addedtothe bidopening device 
20 in Fig. 6 embodiment. The pieces of bidding informa- 
tion Y m » Q m and ,D m are written and published on the 
55 bulletin board 25. The sequencer 61 reads out Q,, 
Q 2 , .... Q M from the bulletin board 25, then sequences 
them in descending order, and sequences m = 1, 2, .... 
M corresponding to the sequenced Q ra , thereafter out- 
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putting them in the sequential order. The control part 21 
checks, tor each index k, whether ID m and y m match 
each other in the sequence of m defined by the sequenc- 
er 61 . The bidding device 10 m , which corresponds to m 
for which the match was detected for the first time, is s 
determined as the winning bidder. 
[0225] Fig. 32 is a flowchart depicting the bid-opening 
procedure of the bid-opening device 20 shown in Fig. 
31, which steps SO to S7 are identical with steps SO to 
S7 in Fig. 7 but differ in step 8 and the subsequent steps. 10 
Roughly speaking, steps S8 and S9 are new steps add- 
ed between steps S7 and S8 in Fig. 7. Step S8 and the 
subsequent steps will be described below. 
[0226] In step S8 the bid-opening device 20 makes a 
check to determine whether the matching in steps S6 to is 
S1 1 has been completed for all fractions for the cur- 
rent value of k. If not completed, the procedure goes to 
step S9. In step S9 P the bid-opening device 20 selects 
the largest one of the remaining fractions Q m to deter- 
mine the corresponding m. In step S10, the device 20 20 
reads out of the data storage part 36 updated data 
D m < k >=h k (l V m ) corresponding to that m, and processes 
the read-out data by the one-way function g processor 
23, thereby updating it such that D m 0<)<-g(D m ( k >). In step 
S11 , the control device 21 makes a check to see if the 25 
updated data D m W corresponding to m matches the bid- 
ding price information y m corresponding to m on the bul- 
letin board 25, and if not, then the procedure returns to 
step S8. 

[0227] When it is decided in step S8 that the matching so 
for all the fractions Q m for the current k has been com- 
pleted, the bid-opening device 20 decrements k by one 
in step S12, and returns to step S8, repeating the same 
procedure as mentioned above. When it is decided in 
step S11 that the updated data D m W and the bidding 35 
price information y m match, the bid-opening device 20 
determines in step S1 3 that the index k at that time is 
the successful index, and outputs the identifier ID m cor- 
responding to that information y m and the successful 
bidding price F(k)4Q m (or merely the index k). 40 
[0228] Since D m < k ) and gm are matched for the cu rrent 
value of the index k in the descending order of the frac- 
tions Q m as described above, the highest bidding price 
can be determined at the first detection of matching be- 
tween D m W and y m . The value m selected in step S9 is 45 
determined by the sequencer 61 which sequences in 
descending order the fractions Q 1t Q2, .., Q M read out 
of the bulletin board 25, and sequences m correspond- 
ingly, as explained before. 

[0229] In the case where the lowest bidding price bid so 
is a successful bid, the bidding prices are arranged in 
monotonous increasing order in the direction opposite 
to that in which the values of the index k are arranged 
in monotonous decreasing order, and the sequencer 61 
sequences the fractions Q 1 , Q 2 , . . . , Qm in ascending or- 55 
der, and sequences m correspondingly. In step S9 the 
smallest one of the unprocessed fractions is chosen, 
and the corresponding m is determined. The sequencer 



61 determines the order of m. 

[0230] The technique that uses may fractions Q m as 
described above can be applied not only to the first em- 
bodiment but also to the other embodiments explained 
heretofore. 

Electronic Competitive Auction System With Provisional 
Identifier Device 

[0231] In the embodiments described above, since 
the bidding device identifier ID m is contained in the bid- 
ding information and sent to the bid-opening device 20, 
it can be said that these embodiments employ what is 
called a sealed-bit auction system. Fig. 33 illustrates in 
block form an electronic competitive auction system 
which uses a provisional identifier registration device to 
implement a secret-bit auction. 
[0232] Each bidding device 10 m is adapted to com- 
municate with a provisional identifier registration device 
70. Referring to Fig. 34, the operation of this electronic 
competitive auction system will be described below. 
[0233] Step SO: Notice of auction is input to each bid- 
ding device 10 m . 

[0234] Step S1 : Upon receiving the notice of auction, 
the bidding device 10 ; outputs the identifier 1D m to the 
provisional identifier registration device 70. 
[0235] Step S2: For the identifier ID m provided there- 
to, the provisional identifier registration device 70 issues 
a provisional identifier AID m , then stores ID m and AID m 
in pair form on a recording medium 71 , and sends the 
provisional identifier AID m to the bidding device 10y 
[0236] Step S3: The bidding device 10 m : generates 
the bidding price PR m ; 

[0237] Step S4: Transforms the bidding price PR m to 
the bidding price information y m ; and 
[0238] Step S5: Sends the bidding price information 
y m and the provisional identifier A1D m to the bid-opening 
device 20. 

[0239] Step S6: The bid-opening device 20: calcu- 
lates a successful bid from the bidding price indexes re- 
ceived from all the bidding deices; and Step S7: Outputs 
the successful bid and the provisional identifier of the 
bidding device having offered the successful bid. 
[0240] Thus, it is possible to keep the auction partic- 
ipants secret. Incidentally, when inquiring the provision- 
al identifier registration device 70, the bidopening de- 
vice 20 can learn the identifier ID m corresponding to the 
successful bid from the provisional identifier AID m . This 
method can be applied to all of the embodiments ex- 
plained hereinbefore. 

[0241] The bidding device 10 m and the bid-opening 
device 20 can be implemented by interpreting and exe- 
cuting programs with a computer. 

EFFECT OF THE INVENTION 

[0242] As described above, according to the present 
invention, since the bidding price is transformed to a bid- 
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ding price information through utilization of a one-way 
function and is then sent to the bid-opening device, it is 
possible to keep the bidding price of each bidding device 
secret from the other bidding devices prior to bidding, 
ensuring fairness of auction. 

[0243] By publishing h K+1 (IVj and h^lVJ corre- 
sponding to a winning bidding price on the bulletin 
board, it is possible for all bidding devices to verify 
whether the winning bidding price was correctly bid with- 
out being altered. 

[0244] Furthermore, the present invention permits de- 
termination of the winning bid while hiding the other bid- 
ding prices. 

[0245] According to the second embodiment, the bids 
of losing bidders, except the winning bid, are kept secret 
even from the bidopening device. 
[0246] According to the third embodiment, the bids of 
losing bidders, except the winning bid, are kept secret 
even from the bid-opening device, and in addition, the 
amount of data for communication with the bidding de- 
vice can be reduced. 

[0247] According to the fourth embodiment, there is 
no fear of the bidding price of each bidding device being 
revealed to the other devices, and at the bid-opening 
time the successful bid can easily be specified directly 
from the bidding price; furthermore, the validity of the 
winning bid can be verified. 

[0248] According to the fifth embodiment, bidding 
price information including each bidding price index is 
generated using a one-way function, and the bidding 
price information for all bidding price indexes is sent to 
the bid-opening device; hence, the aimed bidding price 
can be kept secret. 

[0249] According to the sixth embodiment, either h 
(H m (*D) = H m (>0 or g(H m <k-D) = H m ( K ) needs only to be 
verified for each index value and for each bidding de- 
vice. 

[0250] According to the seventh embodiment, each 
bidding device generates the bidding price information 
including select information for only indexes larger than 
the bidding price index in the fifth embodiment, the 
computational complexity can be reduced. 
[0251] According to the eighth embodiment, since a 
desired bidding price is expressed by the sum of frac- 
tions Q of a price F(k) corresponding to the index k, an 
arbitrary price can be bid with a small number of index- 
es. 



Claims 

1. A quantitative competition method for a system in 
which a plurality of participant devices send their se- 
cret aimed values to a server device and said server 
device determines which of said plurality of partici- 
pant devices has offered the maximum or minimum 
one of said aimed values received, said method 
comprising the steps wherein: 



(a) each of said participant devices processes 
an initial value peculiar to said participant de- 
vice with a predetermined one-way function by 
the number of times corresponding to said 

s aimed value to generate aimed value informa- 

tion; 

(b) either one of said each participant device 
and said server device processes said initial 
value with said one-way function to generate 

io an updated initial value; 

(c) said server device makes a checkfor match- 
ing between said updated aimed values and 
said aimed value information of said participant 
devices; and 

is (d) upon first detection of matching in said step 

(c), said server device decides that said aimed 
value of that one of said participant devices 
which corresponds to said updated value hav- 
ing matched said aimed value information is 

20 maximum or minimum. 

2. The method of claim 1 , further comprising a step of 
repeating the updating of said initial value in said 
step (b) and the check for matching in said step (c) 

25 when no matching is detected in said step (c). 

3. The method of claim 2, wherein said step (b) in- 
cludes a step of generating said updated initial val- 
ue by said server device. 

30 

4. The method of claim 3, wherein: there is provided 
a conversion table showing the relationships be- 
tween a sequence of values selectable as said 
aimed values and a sequence of indexes k of inte- 

35 gral values corresponding thereto; 

said step (a) includes a step wherein, letting M 
be the number of participant devices, an m-th 
participant device m computes said aimed val- 
40 ue information by 

45 where g is a one-way function , IV m is said initial 

value, 1^ is an index corresponding to said 
aimed value of said participant device m, and 
h km (IV m ) indicates that said initial value IV m is 
processed with said one-way function h by k m 

50 times; 

said step (b) includes a step wherein said serv- 
er device generates said updated initial value 
by 

D m = g(h k (IV m) ); 

and 
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said step (c) includes a step of making a check 
for said aimed value information y m - D m . 

5. The method of claim 2, wherein said step (b) in- 
cludes a step wherein said each participant device 
generates said updated value by the number of 
times requested by said server device and sends 
said updated initial value to said server device. 

6. The method of claim 5, wherein: there is provided 
a conversion table showing the relationships be- 
tween a sequence of values selectable as said 
aimed values and a sequence of indexes k of inte- 
gral values corresponding thereto; and 

said step (a) includes the steps wherein: 

(a-1 ) letting M be the number of participant de- 
vices, an m-th participant device m computes 
said aimed value information by 

Y m =g(h ton cv m )) 

where g is a one-way function, IV m is said initial 
value, k^ is an index corresponding to said 
aimed value of said participant device m, and 
h^flVJ indicates that said initial value IV m is 
processed with said one-way function h by ^ 
times; 

(a-2) said each participant device generates 
verification information C m = h K+1 (IV m ) and 
sends it to said server device together with said 
aimed value information y m ; and 
(a-3) said server device publishes said aimed 
value information Y m and said verification infor- 
mation C m = h K+1 (I V m ) received from said each 
participant device on a bulleting board acces- 
sible from all of said participant devices. 

7. The method of claim 6, wherein: said step (b) in- 
cludes the steps wherein: 

(b-1) said server device requests said each 
participant device to send D m = h^l V m ) corre- 
sponding to said index k; and 
(b-2) said each participant device responds to 
the request of said server device to generate 
D m = h k (l V m ) corresponding to said index k as 
said updated initial value and sends it to said 
server; and 

said step (c) includes a step of generating g 
(D m ) and making a check for said aimed value in- 
formation Ym = 9(D ro ). 

8. The method of claim 7, wherein: said step (b) in- 
cludes a step (b-0) wherein said server device sets 
said index k to an upper limit value K; and 



said step (c) includes the steps wherein said 
server device: 

(c-1 ) publishes said D m = h k (l V m ) received from 
5 said each participant device on said bulletin 

board; 

(c-2) computes said g(D ro ) for said each partic- 
ipant device m; 

(c-3) makes a check to see if said g(D m ) match- 
to es said aimed value information; 

(c-4) if no match is detect for any of said m in 
said step (c-3), replaces said D m with said C m , 
decrementing said index k by one and returns 
to said step (b-1); and 
is (c-5) if a match is detected in said step (c-3), 

determines that the value corresponding to said 
index k at that time is said maximum or mini- 
mum aimed value. 

20 9. The method of claim 8, wherein said step (c-1 ) in- 
cludes a step wherein said server device generates 
h(DJ and makes a check to see if h(DJ = C m 
holds. 

25 io. The method of claim 8, wherein said step (c-5) in- 
cludes a step wherein said server device publishes 
said determined maximum or minimum aimed value 
and said h krn (IV m ) on said bulletin board. 

30 11. The method of claim 5, wherein: there is provided 
a conversion table showing the relationships be- 
tween a sequence of values selectable as said 
aimed values and a sequence of indexes k of inte- 
gral values corresponding thereto; and 

35 

said step (a) includes the steps wherein: 

(a-1 ) letting M be the number of participant 
devices, an m-th participant device m com- 
40 putes said aimed value information by 

y ra = 9(h kn, (iv m )) 

45 where g is a one-way function, IV m is said 

initial value, ^ is an index corresponding 
to said aimed value of said participant de- 
vice m, and h km (IV m ) indicates that said in- 
itial value IV m is processed with said one- 

so way function h by ^ times; 

(a-2) said each participant device gener- 
ates verification information C m = h K+1 
(I V m ) and sends it to said server device to- 
gether with said aimed value information 

55 Ym ; and 

(a-3) said server device publishes said 
aimed value information Y m and said verifi- 
cation information C m = h K+1 (IV m ) received 
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from said each participant device on a bul- 
leting board accessible from all of said par- 
ticipant devices; 

said step (b) includes the steps wherein: said s 
server device: 

(b-0) said server device sets said index k 
to an upper limit value K; 
(b-1 ) said server device inquires said each io 
participant device m about whether said 
aimed value information corresponds to 
said index; 

(b-2) said server device checks whether an 
answer from said each participant device is 
acknowledges said correspondence; 
(b-3) if said answer from said each partici- 
pant device denies said correspondence, 
said server device decrements said k by 
one and returns to said step (b-1 ); 20 
(b-4) if said answer from said each partici- 
pant device acknowledges said corre- 
spondence, said server device requests 
said each participant device to present an 
updated initial value h k (IV m ); 25 
(b-5) said each participant device gener- 
ates D m = h^l V m ) using said initial value 
IV m of its own and sends said D m to said 
server device; and 

(b-6) said server device publishes said D m 30 
from said each participant device on said 
bulletin board; and 

said step (c) includes the steps wherein said 
server device: 35 

(c-1 ) generates h(D m )'s for all of said D m 's 
received from all of said participant devic- 
es; 

(c-2) checks whether said h(D m )'s match 40 
said verification information C m 's on said 
bulletin board, respectively; 
(c-3) if no mismatch is detected in said step 
(c-1), generates g(D|) for D ] presented by 
a participant device j having bid; 45 
(c-4) checks whether said g(Dj) matches 
said aimed value information tj of said par- 
ticipant device j on said bulletin board; and 
(c-5) if said g(Dj) matches said yj in said 
step (c-4), decides that said participant de- &> 
vice j sent to said server device said aimed 
value information corresponding to said 
aimed value k. 

12. The method of claim 1, wherein: there is provided 55 
a conversion table showing the relationships be- 
tween a sequence of values selectable as said 
aimed values and a sequence of indexes k of inte- 



gral values corresponding thereto; and 

said step (a) includes the steps wherein: 

(a-1 ) letting M be the number of participant 
devices, an m-th participant device m com- 
putes said aimed value information by 

Y m = g(h kn '(ivj) 

where g is a one-way function, I V m is said 
initial value, ^ is an index corresponding 
to said aimed value of said participant de- 
vice m, and h^l V m ) indicates that said in- 
itial value IV m is processed with said one- 
way function h by k^ times; 
(a-2) said each participant device gener- 
ates verification information C m = h K+1 
("VJ; 

(a-3) said each participant device m gen- 
erates h(PR m (+)RJ from a random 
number R m and said aimed value PR m and 
sends said h(PR m (+)R m ) to said server de- 
vice together with said y m and said C m , said 
(+) represents a predetermined arbitrary 
operation; 

said step (b) includes the steps wherein: 

(b-1) said server device publishes its re- 
ceived Ynv h(PR m (+)RJ and ID m on said 
bulletin board; 

(b-2) said server device requests said each 
participant device to present said aimed 
value PRm and said random number R m ; 
(b-3) said each participant device sends 
said aimed value PR m and said random 
number to said server device; 
(b-4) said server device determines from 
its received PR m and R m an index k corre- 
sponding to the maximum one of said 
aimed values and a participant device j 
having sent said aimed value information 
corresponding to said index k; 
(b-5) said server device request all of said 
participant devices to present h^l V m ); and 
(b-6) said each participant device gener- 
ates D m =h k (l V m ) as said updated initial val- 
ue using the initial value IV m of its own, and 
sends said D m =h k (IVJ to said server de- 
vice; 

said step (c) includes the steps wherein said 
server device: 

(c-1) publishes all of its received D m 's on 
said bulletin board; 
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(c-2) generating h(D m )'s for all of said D m 's; 
(c-3) checks whether said h(D m )'s match 
said verification information C m 's on said 
bulletin board, respectively; 
(c-4) if no mismatch is detected in said step 5 
(c-3), generates g(D|) for Dj presented by 
said participant device j having sent said 
maximum aimed value determined in said 
step (b-4); and 

(c-5) checks whether said g(Dj) matches 10 
said aimed value information of said par- 
ticipant device j on said bulletin board; and 

said step (d) includes a step wherein if a match 
is detected in said step (c-5), said server device is 
decides that said participant device j sent said 
aimed value information for said aimed value k. 

13. The method of claim 12, wherein said step (d) in- 
cludes the steps of: 20 

(d-1) generating E m - g(h*- k (h k (IV m )) fort such 
that k<t<K and for all of said m's except said j; 
(d-2) checking whether these E m 's match said 
aimed value information y m on said bulletin 25 
board; and 

(d-3) if no match is detected in said step (d-2), 
deciding that said k is an index corresponding 
to the maximum or minimum aimed value, and 
outputting said k and said identifier I D m of said 30 
participant device j having presented said 
aimed value. 

14. The method of claim 12 or 13, wherein: said each 
participant device m adds to. the computation using 35 
said aimed value PR m and said random number R m 

in said step (a-3) additional information l m about 
said aimed value information by said each partici- 
pant device m, and outputs h(PR m (+)l rn (+)R m ); and 

in said step (b-2) said server device requests 40 
all of said participant devices to present said addi- 
tional information l m as well as said aimed value 
PR m and said random number R m . 

15. The method of claim 1 , wherein: there is provided *s 
a conversion table showing the relationships be- 
tween a sequence of values selectable as said 
aimed values and a sequence of indexes k of inte- 
gral values respectively corresponding thereto; 

50 

said step (a) includes the steps wherein: 

(a-1 ) each said bidding device generates h 
(H m W) as aimed value information of said 
each participant device by repeating, for 55 
each of a sequence of index values k from 
at least k^ corresponding to an aimed val- 
ue of said each participant device to an up- 



per limit index value K, processing of: 

combining an initial value of said each 
participant device with select informa- 
tion to provide combined information 
and 

operating a one-way function h on said 
combined information to generate an 
updated value, said select information 
indicating whether said each index val- 
ue k is an aimed value or not; and 
sends said aimed value information 
H m W to said server device; 

(a-2) said server device publishes said re- 
ceived aimed value information on a 
bulletin board accessible from all of said 
participant devices; 

said step (b) includes the steps wherein: 

(b-1 ) said server device requests said each 
participant device to send an updated initial 
value {H m < k - 1 >, b m < k )} corresponding to 
each value of said index k in the descend- 
ing order from K; and 
(b-2) said each participant device gener- 
ates and sends {H m < k - 1 ), b m M] as said up- 
dated initial value to said server device; 

said step (c) includes the steps wherein said 
server device: 

(c-1 ) publishes on said bulletin board said 
updated initial value (H m ( k - 1 ), b m M] re- 
ceived from said each participant device; 
(c-2) processes said updated initial value 
H m < k ) with a one-way function h to generate 
H m ( k ) = h(H rn ( k -D||b m ( k )); 
(c-3) checks whether said updated initial 
value H m 0<) matches H m < k ) received previ- 
ously; and 

(c-4) if a match is detected in said step (c- 
3), decides whether said select information 
b m < k ) represents that the corresponding in- 
dex k is the index ^ of said aimed value; 
and 

said step (d) is a step wherein if the result of 
decision in said step (c-4) is true, said server 
device outputs said index concerned and the 
corresponding participant device number m, 
and if the result of decision is false, said server 
device returns to said step (b) and repeats 
processing for the next index value k. 

16. The method of claim 1, wherein: there is provided 
a conversion table showing the relationships be- 
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tween a sequence of values selectable as said 
aimed values and a sequence of indexes k of inte- 
gral values respectively corresponding thereto; 

said step (a) includes the steps wherein: 5 

(a-1 ) upon each processing of said initial 
value with said one-way function h, said 
each participant device generates an up- 
dated initial value by adding said proc- to 
essed initial value with select information 
b m < k ) indicating whether said processed in- 
itial value is an aimed value for one value 
of said index k, and generates H m W by re- 
peatedly performing this processing from « 
at least that index ^ of a sequence of in- 
dexes which corresponds to said aimed 
value to the upper limit value K, and sends 
said H m W as said aimed value information 
to said server device; 20 
(a-2) said server device publishes its re- 
ceived aimed value information H m W on a 
bulletin board accessible from all of said 
participant devices; 

25 

said step (b) includes the steps wherein: 

(b-1) for each value of said index k in de- 
scending order from K, said server device 
inquires said each participant device about 30 
whether it has bid for said index k, and said 
each participant device responds YES or 
NO to said inquiry; 

(b-2) upon first detection of the response 
YES, said server device requests said 35 
each participant device to send its updated 
initial value H m ( k_1 ); and 
(b-3) said each participant device gener- 
ates and sends (H m ( k ' 1 ) = h(H J^lbJ* 1 )) 
as said updated initial value to said server 40 
device; 

said step (c) includes the steps wherein said 
server device: 

45 

(c-1) publishes on said bulletin board said 
updated initial value (H m < k - 1 >) received from 
said each participant device; 
(c-2) letting a and a represent predeter- 
mined values of said select information so 
b m < k > indicating bidding and not bidding, re- 
spectively, generate, for said participant 
device m having bid for the current index k, 

H rn = h(...h(h(H m (k - 1) ||a)||a)...||a) 

through the use of said updated initial value 



H m < k - 1 >, and for every one of the other par- 
ticipant devices m, generate 

H m = hC..h(h(H rn (k " 1) ||a)||a).-.||a) 

through the use of said updated initial val- 
ues H m < k -1); 

(c-3) checks whether said H m for said each 
participant device matches said H m ( k ) pub- 
lished on said bulletin board; and 
(c-4) if a match is detected in said step (c- 
3), determines that said participant device 
having responded YES is the winning bid- 
ding device, and publishes the current val- 
ue of said index k as the index K m of the 
aimed value of said winning bidding de- 
vice. 

17. The method of claim 1, wherein: there is provided 
a conversion table showing the relationships be- 
tween a sequence of values selectable as said 
aimed values and a sequence of indexes k of inte- 
gral values respectively corresponding thereto, and 
let the initial value of said each participant device 
be represented by IV m , where m = 1, 2, M, M 
being an integer equal to or greater than 2; 

said step (a) is a step wherein said each par- 
ticipant device generates H m W = h K - km (g xm 
(IV m )) using a predetermined positive integer 
x^ said initial value I V m and one-way functions 
h and g, and sends said H^*) as said aimed 
value information to said server device; 
said step (b) includes the steps wherein: 

(b-1) said server device publishes said 
aimed value information A,,, on a bulletin 
board accessible from all of said participant 
devices; 

(b-2) said server device sends said index 
k to said each participant device to ask for 
its updated initial value; 
(b-3) said each participant device decides 
whether its received index k is the index l^ 
corresponding to said aimed value; 
(b-4) if the result of decision in step (b-3) is 
k = k^, said each participant device gener- 
ates and sends H m ^ ) = g*™- 1 (I V m ) as said 
updated initial value to said server device; 
and 

(b-5) if the result of decision in said step (b- 
3) is not k= k^, said each participant device 
generates and sends H m < k ' 1 ) = h k krn - 1 (g xm 
(I V m )) as said updated initial value to said 
server device; 

said step (c) includes the steps wherein said 
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server device: 

(c-1) processes said updated initial value 
H m ( k ' 1 )wrth said one-way function h to gen- 
erate h(H m <M>); s 
(c-2) decides whether said h(H m ( k1 )) is 
equal to said aimed value information 

HJO; 

(c-3) if it is decided in said step (c-2) that 
they are equal, updates said aimed value 10 
information H m W with said updated initial 
value H m < k ' 1 >, then decrements said index 
k by one and return to said step (b-2); 
(c-4) if it is decided in said step (c-2) that 
they are not equal, processes said updated 1$ 
initial value H m ( k " 1 ) with said one-way func- 
tion g to generate g(H m ( k - 1 )); and 
(c-5) decides whether said g(H m ( k ' 1 >) 
matches said aimed value information 
H m («<); and 20 



said step (d) is a step wherein if a match is de- 
tected in said step (c-5), decides that the aimed 
value of said participant device corresponding 
to m and k having provided said match is the 
maximum or minimum. 

18. The method of claim 1 , wherein: there is provided 
a conversion table showing the relationships be- 
tween a sequence of values selectable as said 
aimed values and a sequence of indexes k of inte- 
gral values respectively corresponding thereto; 



(b-2) upon first detection of the response 
YES, said server device requests said 
each participant device to send its updated 
initial value H^ 1 ); 

(b-3) said each participant device decides 
whether its received k is the index k corre- 
sponding to said aimed value; 
(b-4) if the result of decision in said step (b- 
3) is k= said each participant generates 
and sends H m ( k1 ) = tf^flVJ as said up- 
dated initial value to said server device; 
and 

(b-5) if the result of decision in said step (b- 
3) is not k= k^, said each participant device 
generates and sends H m < k_1 ) = g^^lv^) 
as said updated initial value to said server 
device; and 

said step (c) includes the steps wherein said 
server device: 

(c-1) for said updated initial value H m < k l ) 
received from said participant device hav- 
ing responded YES, generates 

and for said updated initial value received 
30 from said each participant device having 

responded NO, generates 



(c-2) checks whether all of said H m are 
equal to said aimed value information 
H m (K) published on said bulletin board; and 
(c-3) if it is decided in said step (c-2) that 
they are equal, determines that said partic- 
ipant device having responded YES is the 
winning bidding device, and publishes the 
current value of said index k as the index k 
of the aimed value of said winning bidding 
device. 

19. The method of claim 1, wherein: there is provided 
a conversion table showing the relationships be- 
tween a sequence of values selectable as said 
aimed values and a sequence of indexes k of inte- 
gral values respectively corresponding thereto, and 
let the initial value of said each participant device 
be represented by IV m , where m = 1, 2, .... M ( M 
being an integer equal to or greater than 2; 

said step (a) is a step wherein said each par- 
ticipant device generates H^K) = hK^gx™ 
(IV m )) using a predetermined positive integer 



said step (a) includes the steps wherein: 

35 

(a-1), letting the initial value of said each 
participant device be represented by IV^, 
where m = 1, 2, M, M being an integer 
equal to or greater than 2, said each par- 
ticipant device generates H„flQ = h Kkm *o 
(gxm(iv m )) using a predetermined positive 
integer x m , said initial value IV m and one- 
way functions h and g, and sends said H m 
as said aimed value information to said 
server device; and 4$ 
(a-2) said server device publishes its re- 
ceived aimed value information H m <*> on a 
bulletin board accessible from all of said 
participant devices; 

50 

said step (b) includes the steps wherein: 

(b-1) for each value of said index k in de- 
scending order from K, said server device 
inquires said each participant device about & 
whether it has bid for said index k, and said 
each participant device responds YES or 
NO to said inquiry; 



21 



41 



EP 1 071 025 A2 



42 



x m , said initial value IV m and one-way functions 
h and g, and sends said as said aimed 
value information to said server device; 
said step (b) includes the steps wherein: 

5 

(b-1) said server device publishes said 
aimed value information on a bulletin 
board accessible from all of said participant 
devices; 

(b-2) said server device sends said index 10 
k to said each participant device to ask for 
its updated initial value; 
(b-3) said each participant device decides 
whether its received index k is the index k,,, 
corresponding to said aimed value; 1$ 
(b-4) if the result of decision in step (b-3) is 
k - k^, said each participant device gener- 
ates and H m ( k ~ 1 > = g^ MIVJ as said up- 
dated initial value and sends it to said serv- 
er device together with a flag indicating that 20 
said k and are equal; and 
(b-5) rf the result of decision in said step (b- 
3) is not k = k^, said each participant device 
generates and sends H m ( k " 1 ) = h k km - 1 (g xm 
(IV m )) as said updated initial value to said 25 
server device; 

said step (c) includes the steps wherein said 
server device: 

30 

(c-1) checks whether its received updated 
initial value Hj** 1 ) is added with said flag; 
(c-2) if it is decided in said step (c-1) that 
said flag is added, processes said updated 
initial value H m ( k1 ) with said one-way f unc- 35 
tbn g to generate g(H m ( k_1 )); 
(c-3) decides whether said gfH^ 1 )) 
matches said aimed value information 

(c-4) if it is decided in said step (c-1) that 40 
no flag is added, processes said updated 
initial value H m ( k_1 ) with said one-way func- 
tion h to generate h(H m ( k1 >); 
(c-5) decides whether said h(H m < k_1 >) 
matches said aimed value information 45 

(c-6) if it is decided in said step that they 
are equal, updates said aimed value infor- 
mation H m W with said initial value H m < k ~ 1 ), 
then decrements said index k by one and &> 
return to said step (b-2); and 
(c-7) if it is decided in said step (c-5), proc- 
esses said initial value H m < k ' 1 > with said 
one-way function g to generate gfH^ 1 )) 
and returns to said step (c-3); and & 

said step (d) is a step wherein if a match is de- 
tected in said step (c-3), decides that the aimed 



value of said participant device corresponding 
to m and k having provided said match is the 
maximum or minimum. 

A quantitative competition method for a system in 
which a plurality of participant devices send their se- 
cret aimed values to a server device and said server 
device determines which of said plurality of partici- 
pant devices has offered the maximum or minimum 
one of said aimed values received, and in which 
there is provided a conversion table showing the re- 
lationships between a sequence of values selecta- 
ble as said aimed values and a sequence of indexes 
k of integral values respectively corresponding 
thereto, and m = 1, 2, M, M being an integer 
equal to or greater than 2; said method comprising 
the steps wherein: 

(a) each of said participant devices processes, 
with a predetermined one-way function h and 
through the use of said conversion table, infor- 
mation kf+Jb^f+JRroM, which contains each 
index k equal to or larger than an index k^ cor- 
responding to said aimed value, select informa- 
tion b m W indicating whether said index k corre- 
sponds to said aimed value, and a random 
number R m (k \ to generate at least K-k^+1 piec- 
es of aimed value information h(k(+)b m ( k >(+) 
R m (k) )> and sends these pieces of aimed value 
information to said server device, A(+)B repre- 
senting a predetermined arbitrary operation; 

(b) said server device publishes its received 
aimed value information on a bulletin board ac- 
cessible from all of said participant devices; 

(c) said server device obtains said random 
number R^, corresponding to each of said se- 
quence of indexes k; 

(d) letting a be a predetermined value with 
which said select information b m W indicates 
said aimed value, said server device calculates 
h(kWa( + )R m ^); 

(e) said server device checks said aimed val- 
ues on said bulletin board for matching with 
said calculated h(k(+)a(+)Rm< k )); and 

(f) if a match is detected in said step (e), said 
server device decides that the aimed value of 
the aimed value information of a participant de- 
vice having sent said random number R rn < k ) at 
that time is the maximum or minimum value. 

The method of claim 20, further comprising a step 
wherein if a match is detected in said step (d), said 
server device repeats said steps (c), (d) and (e) for 
the next value of said index k. 

The method of claim 21 , wherein said step (c) in- 
cludes the steps wherein: said server device re- 
quests said each participant device to send said 
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random number R m M corresponding to said index 
k; said each participant device sends said request- 
ed random number R m M to said server device; and 
said server device receives said random number 



23. The method of claim 21, wherein: 

said step (a) includes a step wherein said each 
participant device sends said aimed value in- 10 
formation h(k(+)b ra W(+)R m W) to said server 
device together with said random number 

said step (b) includes a step wherein said serv- 
er device stores said random number R m ^ in is 
a nonpublic memory; and 
said step (c) includes the steps wherein: said 
server device requests said each participant 
device to send said random number R m < k > cor- 
responding to said index k; said each partici- 20 
pant device sends said requested random 
number R m (*) to said server device; and said 
server device receives said random number 

R m (k) 

25 

24. The method of claim 4, 12, 15, 16, 17, 18, 19 or 20 
wherein said sequences of indexes k and values se- 
lectable as said aimed values are both monotonous 
increasing values in the same direction, and in said 
step (c) said server device determines the maxi- 30 
mum aimed value. 

25. The method of claim 4, 12, 15, 16, 17, 1B, 19 or 20, 
wherein said sequences of indexes k and values se- 
lectable as said aimed values are both monotonous 35 
increasing values in opposite directions, and in said 
step (c) said server device determines the minimum 
aimed value. 

26. The method of claim 4, 1 2, 1 5, 1 6, 1 7, 1 8, 1 9 or 20, 40 
wherein let an arbitrary aimed value be represented 

by PR = F(k)+Q, where F(k) is a value in said con- 
version table corresponding to said index k and Q 
is a fraction which is a positive integer which satis- 
fies F(k+1)-F(k)>Q>0; 45 

said step (a) includes a step wherein, letting 
said aimed value PR m of said each participant 
device m be represented by PF^ = Ffk^J+Q,^, 
said each participant device m generates said 
aimed value information by processing said in- 
itial value with said one-way function h by the 
number of times corresponding to k m , sends 
said aimed value information to said server de- 
vice together with said fraction Q^, where m = 55 
1, 2, M, M being an integer equal to or great- 
er than 2; 

said step (b) includes a step wherein said serv- 



er device publishes said aimed value informa- 
tion and said fraction Q m on a bulletin board ac- 
cessible from all of said participant devices; 
said step (c) includes a step where said server 
device makes a check for matching between 
said updated initial value and said aimed value 
information for each index value in an ascend- 
ing or descending order of said fraction Q m 
where m = 1 , 2, ... M; and 
said step (d) includes a step wherein upon first 
detection of a match in said step (c), said server 
device finishes said check and determines, 
from k^ and m at the time of detecting the 
match, that PR m = F(k m )+Q m is said maximum 
or minimum aimed value. 

27. The method of claim 1, 4, 12, 15, 16, 17, 18, 19 or 
20, further comprising the steps wherein: 

(0-1) said each participant device m sends its 
identifier ID m to a provisional identifier registra- 
tion device; 

(0-2) said provisional identifier registration de- 
vice issues a provisional identifier AJD m for said 
identifier ID m , and stores said identifier I D m and 
said provisional identifier AID m in pair form in 
storage means; 

(0-3) said provisional identifier registration de- 
vice sends said provisional identifier AID m to 
said each participant device; and 
(0-4) said each participant device m sends said 
provisional identifier AID m as said identifier to 
said server device, together with said aimed 
value information. 

28. A participant device for a system in which M partic- 
ipant devices send their aimed values to a server 
device and said server device determines which of 
said M participant devices has offered the maximum 
or minimum one of said aimed values received, said 
participant device comprising: 

aimed value generating means; 
aimed value transforming means which proc- 
esses said aimed value with a predetermined 
one-way function by the number of times cor- 
responding to said aimed value to obtain aimed 
value information; and 

sending means for sending to said server de- 
vice said aimed value information and an iden- 
tifier specifying said participant device. 

29. The participant device of claim 28, wherein said 
aimed value transforming means comprises: 

a conversion table for converting said aimed 
value PR m to the corresponding index k^; 
a one-way function h processor which process- 
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es an initial value IV m inherent to said partici- 
pant device with a one-way function h by the 
number of times corresponding to said index 
to obtain an output h^l V m ); and 
a one-way function g processor which process- 
es said output from said one-way function h 
processor with a one-way function g to obtain 
said aimed value information. 

30. The participant device of claim 29, further compris- 
ing verification information generating means which 
generates C m = h K+1 (IV m ) as verification informa- 
tion by processing said initial value IV m with said 
one-way function h K+1 times and sends said veri- 
fication information C m to said server device. 

31. The participant device of claim 28, wherein said 
aimed value information transforming means com- 
prises: 

a memory in which there is stored a conversion 
table which defines the relationships between 
a sequence of monotone varying values se- 
lectable as aimed values and a sequence of in- 
dexes, for converting said aimed value PF^ to 
the corresponding index 
a one-way function h processor which process- 
es an initial value inherent to said participant 
device with a one-way function h by the number 
of time corresponding to said index k^ and out- 
puts h^l V m ); and 

a one-way function g processor which process- 
es the output from said one-way function h 
processor with a one-way function g to obtain 
said aimed value information. 

32. The participant device of claim 28, which further 
comprises: a random generator for generating a 
random number R m ; an operating device for oper- 
ating said random number R m and said aimed value 
PR m to obtain PR m (+)R m ; one-way function h 
processing means for processing said PR m (+)R m 
with a one-way function h to obtain h(PR m (+)R m ); 
and verification information generating means for 
processing said initial value IV m with said one-way 
function h K+1 times to generate C m = h K+1 (IV m ); 
and wherein said h(PR m (+)R m ) and said verification 
information are sent to said server device together 
with said aimed value information. 

33. The participant device of claim 28, wherein said 
aimed value transformer comprises: 

a conversion table memory which has stored 
therein a conversion table which defines index- 
es k = 1, 2, K corresponding to K kinds of 
values selectable as aimed values; 
a select information generator which generates 



select information b m M indicating whether to 
select an aimed value corresponding to each of 
said indexes k = 1, 2, K; 
a random generator which generates a random 
s number R m W inherent to said participant de- 

vice m and said index k; 
an operating device which receives said index 
k, said random number R m ( R ) and said select 
information b m ( k > and performs an operation k 
10 ( + )b m W( + )R ni < k ); 

a one-way function h processor which process- 
es said kt+Jb^C+JRmW with a one-way func- 
tion h to obtain h(k(+)b ra W( + )R m M); and 
a control device which computes said h(k(+) 
15 b m < k )(+)R m M) for each of said indexes k and 

provides the k pieces information as said aimed 
value information. 

34. The participant device of claim 28, wherein said 
20 aimed value transformer comprises: 

a conversion table memory which has stored 
therein a conversion table which defines index- 
es k = 1, 2, K corresponding to K kinds of 
25 values selectable as aimed values, for convert- 

ing said aimed value PR m to the corresponding 
index l^; 

initial value updating means which, for each in- 
dex k, processes an initial value with a one-way 
30 function h and adds the processed initial value 

with select information b m W for said index k to 
obtain an updated initial value and repeats this 
processing until k = K is reached, thereby gen- 
erating HfoOQ; 

35 select information generator which generates 

said select information b m ( k ) whether said 
aimed value corresponds to each index k from 
at least ^ to K; 

a one-way function h processor which process- 
40 es said initial value with said one-way function 

h; 

a concatenator which concatenates said 
H m ( k_1 ) and said select information to generate 
HJ^WJK-WK)); 
45 a buffer which temporarily holds the output from 

said concatenator and outputs said output for 
the next value of said index k; and 
a storage part which, for each value of said in- 
dex k, stores H m ( k > corresponding thereto; and 
50 wherein said sending means is a means which 

responds to a request of said server device for 
said index kto read out H m ( k > from said storage 
part and send said H m W to said server device. 

55 35. The participant device of claim 28, wherein said 
aimed value transformer comprises: 

a conversion table memory which has stored 
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therein a conversion table which defines index- 
es k = 1, 2, .... K corresponding to K kinds of 
values selectable as aimed values, for convert- 
ing said aimed value PR m to the corresponding 
index l^; 5 
a one-way function g processor which process- 
es said initial value I V m with a one-way function 
g by a predetermined number of times ^ to 
generate g^OVJ; 

a one-way function h processor which process- 10 
es said g xm (IV m ) with a one-way function h K- 
k^ times to generate H m 0<) = h^g^l VJ as 
said aimed value information; and 
response generating means which responds to 
a request from said server device for ktodecide is 
whether k^, and if true, generates H m < k * 1 ) - 
hk-km-i(gxm(iv m )), and if false, generates 
Hm (k-i) = g xm-i ( iv m );and 
wherein said sending means sends said H m < k1 > 
in response to said requestf rom said server de- 20 
vice for said k. 

36. The participant device of claim 28, wherein said 
aimed value transformer comprises: 

25 

a conversion table memory which has stored 
therein a conversion table which defines the re- 
lationships between a sequence of values se- 
lectable as said aimed values and a sequence 
of indexes k of integral values respectively cor- 30 
responding thereto, for converting said aimed 
value PR m to the corresponding index k^; 
a fraction calculating part which, letting an ar- 
bitrary aimed value PR be represented by PR 
= F(k)+Q, where F(k) is a value in said conver- 35 
sion table corresponding to said k and Q is a 
fraction which is a positive integer which satis- 
fies F(k+1)-F(k)>Q£0, calculates said fraction 
Q m = PRnfFfk™) based on FfkJ obtained from 
said conversion table and said aimed value 40 
PR m ; and 

a one-way function h processor which process- 
es said initial value I V m with said one-way func- 
tion h by the number of times corresponding to 
said 1^ to generate said aimed value infonma- 45 
tion; and 

wherein said sending means sends said frac- 
tion Q m to said server device together with said 
aimed value information. 

50 

37. A server device for a system in which M participant 
devices send their aimed values to said server de- 
vice and said server device determines which of 
said M participant devices has offered the maximum 
or minimum one of said aimed values received, said 
device comprising: 

a conversion table memory which has stored 
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therein a conversion table which defines the re- 
lationships between a sequence of values se- 
lectable as said aimed values and a sequence 
of indexes k of integral values respectively cor- 
responding thereto, for converting said aimed 
value PR m to the corresponding index k^; 
a bulletin board on which said server device 
writes said aimed value information an identifier 
received from each of said participant devices; 
updated initial value generating means which 
generates an updated initial value by process- 
ing said initial value with a one-way function re- 
peatedly in correspondence with values of an 
index k which is a predetermined consecutive 
positive integers; 

a counter which updates said index k one by 
one; and 

control means which, upon each updating of 
said index k, compares said updated initial val- 
ue with said aimed value information on said 
bulletin board to check whether they match, 
and determines m and k at the time of first de- 
tection of a match. 

38. The server device of claim 37, wherein: there are 
published on said bulletin board 7 m = gfh^lVJ) 
as said aimed value information; 

said updated initial value generating means in- 
cludes a one-way function g processor by 
which a response D m = hk(IV m ) received from 
said participant device in correspondence with 
said index k is processed with a one-way func- 
tion g to generate g(DJ as said updated initial 
value; and 

said control means makes a check to see if 
there exists on said bulleting board said aimed 
value information y m which matches said updat- 
ed initial value g(D m ). 

39. The server device of claim 38, wherein there is pub- 
lished on said bulletin board C m = h»<+i(IV m ) re- 
ceived from said participant device in advance, said 
server device further comprising a one-way function 
h processor which processes said response D m 
with a one-way function h to generate h[D m ), and 

wherein said control means checks whether 
C m - h(D m ) holds, and if not, rewrites said C m with 
said D m and updates said index k on said counter. 

40. The server device of claim 37, wherein: 

there are published on said bulletin board C m 
= h K+1 (IV m ), said aimed value information y m - 
h^lVJ and h(PR m (+)RJ received from said 
each participant device, said PF^ and said R m 
being an aimed value and a random number of 
said each participant device m; 
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said control means decides the maximum or 
minimum aimed value from said aimed values 
PR m and said random numbers received 
from said participant devices, and determines 
the index corresponding to said maximum s 
or minimum aimed value and requests said 
each participant device to send D m = h^flV^,) 
corresponding to said index k^; 
said updated initial value generating means 
comprises a one-way function h processor for 10 
processing D m with a one-way functbn h to 
generate h K+1kmx (D m ), and a one-way function 
g processor for processing Dj with a one-way 
function g to generate g(Dj); and 
said control means makes a check to see if said *s 
n K+i-kmx(D m ) matches C m on said bulletin 
board and if said g(Dj) matches said y m on said 
bulleting board; 

41. The server device of claim 37, wherein: 

there are published on said bulletin board h(k 
(+)b m ( k )(+)R m ( k >) together with said aimed val- 
ue information y m received from said each par- 
ticipant device, said b m < k > being select informa- 25 
tion whether said index k corresponds to its 
aimed value and said R m < k ) being a random 
number generated for said index k; 
said server device further comprises an opera- 
tor for operating k(+)b(+)R m ( k >, and a one-way 30 
function h processor for processing the result 
of said operation with a one-way function h to 
generate h(k(+)b(+)R m < k )), where b is a prede- 
termined value which indicates that said select 
information b^W has selected the aimed value 35 
corresponding to said index k; and 
said control means makes a check for matching 
between said h(k(+)b(+)R m < k >) and said h(k(+) 
bJty+JF^W) on said bulletin board. 

40 

42. The server device of claim 37, wherein: 

there is published on said bulletin board, as 
said aimed value information, generated 
by said each participant device which, upon 45 
each processing of said initial value with a one- 
way function h, added the processed value with 
select information b m M indicating whether said 
value was an aimed value for each value of said 
index k and repeated this processing from at 50 



least the index k^, corresponding to said aimed 
value to the upper limit value K of said index k; 
said updated initial value generating means in- 
cludes a one-way function h processor by 
which {H^ 1 ), b m } received from said each par- 
ticipant device in answer to an inquiry for said 
index k is processed with a one-y function h to 
generate H m ( k > = htHj^flbJM); and 



said server device includes an updated initial 
value comparator for making a check to see if 
said H m ( k ) matches previously received H m ( k ). 

43. The server device of claim 37, wherein: letting an 
arbitrary aimed value PR be represented by PR - 
F(k)+Q, where F(k) is a value in said conversion ta- 
ble corresponding to said index k and Q is a fraction 
which is a positive integer which satisfies F(k+1)-F 
(k)>Q>0 T there is published on said bulletin board 
said fraction Q received from said each participant 
device, together with said aimed value information; 

said server device includes a sequencer for de- 
ciding the sequence of said fractions Q m on 
said bulletin board; 

said updated initial value generating means in- 
cludes a one-way function h processor for 
processing said initial value with a one-way 
function h by k times to generate h k (l V m ) and a 
one-way functbn g processor for processing 
said h k (l V m ) with a one-way functbn g to gen- 
erate D m = g(h k (IVJ);and 
control means makes a check to see if said D m 
matches said aimed value information on said 
bulletin board in the sequence of said fractions 
Or*- 

44. The server device of claim 37, wherein there is pub- 
lished on said bulletin board Hj*) = hK^g™ 
(IV m )) as said aimed value information received 
from said each participant device, which further 
comprises a one-way function h processor by which 
H m ( k " 1 > received from said each participant device 
as an answer to an inquiry for said k is processed 
with a one-way function h to generate h(H m ( k " 1 )), 
and a one-way function g processor for processing 
said answer H m ( k1 > with a one-way function g to 
generate g(H m < k ~ 1 )); and 

wherein said control means: makes a check 
to see if said hfH,^ 1 )) matches said aimed value 
information H m W published on said bulletin board; 
if a match is detected, updates said aimed value in- 
formation H m M with said H m ( k_1 ) and decrements 
said index k on said counter by one; and if a mis- 
match is detected, makes a check to see if said g 
(H m ( k_1 )) matches said aimed value information 
HJM; and if a match is detected, determines, based 
on k and m at that time, the maximum or minimum 
aimed value PR m and the participant device m hav- 
ing offered said value PR^ 

45. The server device of claims 37, 38, 40, 41 , 42, 43 
or 44, wherein: letting an arbitrary aimed value PR 

55 be represented by PR = F(k)+Q, where F(k) is a val- 
ue in said conversion table corresponding to said 
index k and Q is a fraction which is a positive integer 
which satisfies F(k+1 )-F(k)>Q>0, there is published 
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on said bulletin board said fraction Q received from 
said each participant device, together with said 
aimed value information; 

said server device includes: 

5 

a sequencer for deciding the sequence of said 
fractions Q m on said bulletin board; and 
select information comparator for checking 
whether said select information b m 0<) is equal 
to a value b indicating the selection of the aimed io 
value corresponding to said index k in said de- 
cided sequence of fractions Qm 



46. The device of claim 29, 31 , 33, 34, 36, 37, 40, 41 , 

43 or 44, wherein said sequence of index values k is 
and said sequence of values selectable as said 
aimed values on said conversion table are mono- 
tone increasing values in the same direction, and 
said server device determines the maximum aimed 
value. 20 

47. The device of claim 29, 31 , 33, 34, 36, 37, 40, 41 , 
43 or 44, wherein said sequence of index values k 
and said sequence of values selectable as said 
aimed values on said conversion table are mono- 25 
tone increasing values in opposite directions, and 
said server device determines the minimum aimed 
value. 

48. A recording medium on which there is recorded as 30 
a program the procedure which is followed by an m- 

th one of M participant devices, where m = 1 , 2, ... , 
M, in a quantitative competition method for a system 
in which said M participant devices send their aimed 
values to a server device and said server device de- 35 
termines which of said M participant devices has of- 
fered the maximum or minimum one of said aimed 
values. received, and there is provided a conversion 
table showing the relationships between a se- 
quence of values selectable as said aimed values 40 
and a sequence of indexes k of integral values re- 
spectively corresponding thereto, said procedure 
comprising the steps of: 



and 

(b) sending said aimed value information y m = 
gfh^fl V m )) to said server device. 

49. A recording medium on which there is recorded as 
a program the procedure which is followed by an m- 
th one of M participant devices, where m = 1, 2, .... 
M, in a quantitative competition method for a system 
in which said M participant devices send their aimed 
values to a server device and said server device de- 
termines which of said M participant devices has of- 
fered the maximum or minimum one of said aimed 
values received, and there is provided a conversion 
table showing the relationships between a se- 
quence of values selectable as said aimed values 
and a sequence of indexes k of integral values re- 
spectively corresponding thereto, said procedure 
comprising the steps of: 

(a-1 ) processing an initial value inherent to said 
participant device m with a predetermined one- 
way function by the number of times corre- 
sponding to said aimed value to generate 
aimed value information 

Y m = 9(h kn, (IV nl )) 

where g is a one-way function, IV m is said initial 
value, km is an index corresponding to the 
aimed value of said participant device m and 
h^fl V m ) indicates processing of said initial val- 
ue IV m with a one-way function h by km times; 
(a-2) generating verification information C m = 
h K+1 (IV m ) and sending said verification infor- 
mation to said server device together with said 
aimed value information y m , 

(b) generating said initial value updated by the 
number of times requested by said server de- 
vice and sending said updated initial value to 
said server device; and 

(c) sending said aimed value information Y m = 
g(h km (l V m )) to said server device. 

50. The recording medium of claim 49, wherein said 
step (b) includes a step of generating D m = h k (IV m ) 
as said updated initial value corresponding to said 
index k and sending said updated initial value to 
said server device in response to its request. 

51. A recording medium on which there is recorded as 
a program the procedure which is followed by an m- 
th one of M participant devices, where m = 1 , 2, 
M, in a quantitative competition method for a system 
in which said M participant devices send their aimed 
values to a server device and said server device de- 
termines which of said M participant devices has of- 
fered the maximum or minimum one of said aimed 



(a) processing an initial value inherent to said 4S 
participant device m with a predetermined one- 
way function by the number of times corre- 
sponding to said aimed value to generate 
aimed value information 

50 

Y m = g(h ton (iv m )) 

where g is a one-way function, IV m is said initial 
value, km is an index corresponding to the ss 
aimed value of said participant device m and 
nkm C v m) indicates processing of said initial val- 
ue I V m with a one-way function h by km times; 



40 
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values received, and there is provided a conversion 
table showing the relationships between a se- 
quence of values selectable as said aimed values 
and a sequence of indexes k of integral values re- 
spectively corresponding thereto, said procedure s 
comprising the steps of: 

(a-1) computing aimed value information by 

Y m = 9(h kn, (IV m )) 

where g is a one-way function, IV m is said initial 
value, is an index corresponding to the 
aimed value PR™ of said participant device m is 
and h^flV^) indicates processing of said initial 
value IV m with a one-way function h by k^ 
times; 

(a-2) generating verification information C m = 
h K+1 ("V m ); 20 
(a-3) generating h(PR m (+)R m ) from a random 
number R m and said aimed value PR m and 
sending said h(PR m (+)R m ) to said server de- 
vice together with said aimed value information 
y m and said verification inf ormat ion C m , said (+) 25 
indicating a predetermined arbitrary operation; 
(b-1) sending said aimed value PR m and said 
random number R m to said server device in re- 
sponse to its request; and 

(b-2) generating D m = h^lVJ as said updated 30 
initial value corresponding to said index k and 
sending said updated initial value to said server 
device in response to its request to present said 

35 

52. The recording medium of claim 51 , wherein said 
step (a-3) is a step of generating h(PR m (+)R m ) from 
a random number R m , said aimed value PR^, and 
additional information l m about the sending of said 
aimed value information indicated by said partici- 40 
pant device m and sending said h(PR m (+)R m ) to 
said server device, said additional information l m 
being sent to said server device in said step (b-2). 

53. A recording medium on which there is recorded as 45 
a program the procedure which is followed by an m- 

th one of M participant devices, where m = 1 , 2, 
M, in a quantitative competition method for a system 
in which said M participant devices send their aimed 
values to a server device and said server device de- so 
termines which of said M participant devices has of- 
fered the maximum or minimum one of said aimed 
values received, and there is provided a conversion 
table showing the relationships between a se- 
quence of values selectable as said aimed values 55 
and a sequence of indexes k of integral values re- 
spectively corresponding thereto, said procedure 
comprising the steps wherein: 



(a) upon each processing of said initial value 
with said one-way function h, said each partic- 
ipant device generates an updated initial value 
by adding said processed initial value with se- 
lect information b m M indicating whether said 
processed initial value is an aimed value for one 
value of said index k, and generates by 
repeatedly performing this processing from at 
least that index k^ of a sequence of indexes 
which corresponds to said aimed value to the 
upper limit value K, and sends said H m M as 
said aimed value information to said server de- 
vice; 

(b-1) said server device requests said each 
participant device to send an updated initial val- 
ue {H m < k1 ), b^/*)} corresponding to each value 
of said index k in descending order from K; and 
(b-2) said each participant device generates 
and sends {H m ( k - 1 ), b m ( k >} as said updated initial 
value to said server device. 

54. A recording medium on which there is recorded as 
a program the procedure which is followed by an m- 
th one of M participant devices, where m = 1, 2, .... 
M, in a quantitative competition method for a system 
in which said M participant devices send their aimed 
values to a server device and said server device de- 
termines which of said M participant devices has of- 
fered the maximum or minimum one of said aimed 
values received, and there is provided a conversion 
table showing the relationships between a se- 
quence of values selectable as said aimed values 
and a sequence of indexes k of integral values re- 
spectively corresponding thereto, said procedure 
comprising the steps of: 

(a) generating Hj*) = h^fg^lVJ) as said 
aimed value information using a predetermined 
positive integer x m , an initial value IV m and one- 
way functions h and g, and sends said aimed 
value information to said server device; 
(b-1 ) decides whether its received index kfrom 
said server device is the index k^ correspond- 
ing to said aimed value; 
(b-2) if the result of decision in step (b-1 ) is k = 
generating and sending H m (k- 1 ) = g" 11 " 1 
(I V m ) as said updated initial value to said server 
device; and 

(b-3) if the result of decision in said step (b-1 ) 
is not k = generating and sending H^ -1 ) - 
h k km_1 (g xm (IV fn )) as said updated initial value 
to said server device. 

55. A recording medium on which there is recorded as 
a program the procedure which is followed by an ro- 
th one of M participant devices, where m = 1, 2, .... 
M, in a quantitative competition method for a system 
in which said M participant devices send their aimed 
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values to a server device and said server device de- 
termines which of said M participant devices has of- 
fered the maximum or minimum one of said aimed 
values received, and there is provided a conversion 
table showing the relationships between a se- 
quence of values selectable as said aimed values 
and a sequence of indexes k of integral values re- 
spectively corresponding thereto, letting the initial 
value of said each participant device be represent- 
ed by IV m , said procedure comprising the steps of: 

(a) generating H m ( K > = n^^g^l V m )) as said 
aimed value information using a predetermined 
positive integer x ra , an initial value IV m and one- 
way functions h and g, and sends said aimed 
value information to said server device; 
(b-1 ) decides whether its received index k from 
said server device is the index correspond- 
ing to said aimed value; 
(b-2) if the result of decision in step (b-1) is k = 
generating H^/* 1 ) = g xm1 (IV m ) as said up- 
dated initial value and sending said updated in- 
itial value to said server device together with a 
flag indicating that said k and are equal; and 
(b-3) if the result of decision in said step (b-1) 
is not k = k^, generating and sending H m ( k - 1 ) = 
h k km1 (g xm (IV m )) as said updated initial value 
to said server device. 

56. A recording medium on which there is recorded as 
a program the procedure which is followed by an fri- 
th one of M participant devices, where m = 1 , 2, 
M, in a quantitative competition method for a system 
in which said M participant devices send their aimed 
values to a server device and said server device de- 
termines which of said M participant devices has of- 
fered the maximum or minimum one of said aimed 
values received, and there is provided a conversion 
table showing the relationships between a se- 
quence of values selectable as said aimed values 
and a sequence of indexes k of integral values re- 
spectively corresponding thereto, said procedure 
comprising the step of: 

(a) processing, with a predetermined one-way 
function h and through the use of said conversion 
table, information k(+)b m ( k >(+)R m (k) , which contains 
each index k equal to or larger than an index l^ 
corresponding to said aimed value, select informa- 
tion b m ( k > indicating whether said index k corre- 
sponds to said aimed value, and a random number 
R m ( k >, to generate at least K-k m +1 pieces of aimed 
value information h(k(+)b m ( k >(+)R m ( k )), and sends 
these pieces of aimed value information to said 
server device, A(+)B representing a predetermined 
arbitrary operation. 

57. The recording medium of claim 56, wherein said 
procedure further comprises a step of sending to 



56 

said server device a random number R^M corre- 
sponding to the index k received from said server 
device. 

s 58. The recording medium of claim 56, wherein said 
step (a) includes a step of sending a random 
number R m < k > to said server device together with 
said h(k( + )b m ( k )(+)Rj k )). 

io 59. The recording medium of claim 49, 51, 53, 54, 55 
or 56, wherein let an arbitrary aimed value be rep- 
resented by PR = F(k)+Q, where F(k) is a value in 
said conversion table corresponding to said index 
kandQ is a fraction which is a positive integer which 
is satisfies F(k+1 )-F(k)>Q>0; 

said procedure further comprises a step 
wherein, letting said aimed value PR m of said each 
participant device m be represented by PR,,, = F^) 
+Q m , said each participant device m sends said 
20 fraction to said server device together with said 
aimed value information y m . 

60. The recording medium of claim 49, 51, 53, 54, 55 
or 56, wherein said sequences of indexes kand val- 

25 ues selectable as said aimed values are both mo- 
notonous increasing values in the same direction. 

61. The recording medium of claim 49, 51, 53, 54, 55 
or 56, wherein said sequences of indexes kand val- 

30 ues selectable as said aimed values are both mo- 
notonous increasing values in opposite directions. 

62. The recording medium of claim 49, 51 , 53, 54, 55 
or 56, wherein said procedure further comprises the 

35 steps of: 

(0-1 ) sending the identifier ID m of said each par- 
ticipant device to a provisional identifier regis- 
tration device; 

40 (0-2) receiving a provisional identifier AID m 

from said provisional identifier registration de- 
vice; and 

(0-3) sending said provisional identifier AID m as 
an identifier to said server device together with 
45 said aimed value information. 

63. A recording medium on which there is recorded as 
a program the procedure which is followed by a 
server device in a quantitative competition method 

50 for a system in which a plurality of participant devic- 
es send their aimed values to said server device 
and said server device determines which of said 
participant devices has offered the maximum or 
minimum one of said aimed values received, and 

55 there is provided a conversion table showing the re- 
lationships between a sequence of values selecta- 
ble as said aimed values and a sequence of indexes 
k of integral values respectively corresponding 
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thereto, said procedure comprising the steps of: 

(a) publishing aimed value information y m = g 
(h km (IV m )) received from said each participant 
device on a bulletin board accessible from all 
of said participant device, g being a one-way 
function, IV m being said initial value, k m being 
an index corresponding to the aimed value of 
said each participant device m and h^fl V m ) in- 
dicating processing of said initial value I V m with 
a one-way function h by ^ times; 

(b) generating an updated initial value by D m = 
9(h k (IV m )); 

(c) checking whether there is any aimed value 
information y m which is equal to said updated 
initial value D m ; and 

(d) upon first detection of a match in said step 
(c), deciding that the aimed value of the partic- 
ipant device corresponding to said updated in- 
itial value D m which matches said aimed value 
information y m . 

64. The recording medium of claim 63, wherein said 
step (a) includes a step of publishing verification in- 
formation C m = h K+1 (IV m ) received from said each 
participant device on said bulletin board together 
with said aimed value information y m . 

65. The recording medium of claim 64, wherein: said 
step (b) includes the steps of: 

(b-1 ) requesting said each participant device to 
send D m = h*(l V m ) corresponding to said index 
k; and 

(b-2) receiving from said each participant de- 
vice D m = h k (IV m ) as said updated initial value 
corresponding to said index k; and 

said step (c) includes a step of generating g 
(D m ) and making a check for said aimed value in- 
formation y m = 9(D m ). 

66. The recording medium of claim 65, wherein: 

said step (b) includes a step (b-0) of setting 
said index k to an upper limit value K; and 
said step (c) includes the steps of: 

(c-1) publishing said D m - h^lVJ received 
from said each participant device on said bul- 
letin board; 

(c-2) computing said g(D m ) for said each par- 
ticipant device m; 

(c-3) making a check to see if said g(D m ) match- 
es said aimed value information; 
(c-4) if no match is detect for any of said m in 
said step (c-3), replacing said D m with said C m , 
decrementing said index k by one and returning 
to said step (b-1); and 



(c-5) if a match is detected in said step (c-3), 
determining that the value corresponding to 
said index k at that time is said maximum or 
minimum aimed value. 

5 

67. The recording medium of claim 66, wherein said 
step (c-1) includes a step of generating h(D m ) and 
making a check to see if h(D m ) = C m holds. 

10 68. The recording medium of claim 66, wherein said 
procedure includes a step of publishing said deter- 
mined maximum or minimum aimed value and said 
nkm ( ,v m) 00 s 3 ' 0 " bulletin board. 

15 69. The recording medium of claim 63, wherein: 
said step (b) includes the steps of 

(b-0) setting said index k to an upper limit value 

K; 

20 (b-1) inquiring said each participant device m 

about whether said aimed value information 
corresponds to said index; 
(b-2) checking whether an answer from said 
each participant device acknowledges said cor- 

25 respondence; 

(b-3) if said answer from said each participant 
device denies said correspondence, decre- 
menting said k by one and returning to said step 
(b-1); 

30 (b-4) if said answer from said each participant 

device acknowledges said correspondence, re- 
questing said each participant device to 
present an updated initial value h^lV^,); 
(b-5) publishing D m = h^lV^J from said each 

35 participant device on said bulletin board; and 

said step (c) includes the steps of: 
(c-1 ) generating h(D m )'s for all of said D m 's; 



40 (c-2) checking whether said h(D m )'s match said 

verification information C m 's on said bulletin 
board, respectively; 

(c-3) if no mismatch is detected in said step (c- 
1 ), generating g(Dj) for presented by a par- 

45 ticipant device j having bid; 

(c-4) checking whether said g(Dj) matches said 
aimed value information -yj of said participant 
device j on said bulletin board; and 
(c-5) if said g(Dj) matches said y t in said step 

so (c-4), decides that said participant device j sent 

to said server device said aimed value informa- 
tion corresponding to said aimed value k. 

70. The recording medium of claim 63, wherein: 
55 said step (b) includes the steps of: 

(b-1) publishing its received y m , hfP^f+JR^,) 
and ID m on said bulletin board, said (+) indicat- 
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ing a predetermined arbitrary operation; 
(b-2) requesting said each participant device to 
present its aimed value PR m and random 
number F^; 

(b-3) determining from its received PF^ and R m 5 
an index k corresponding to the maximum one 
of said aimed values and a participant device j 
having sent said aimed value information cor- 
responding to said index k; 
(b-4) requesting all of said participant devices io 
to present h k (IV m ); and 

(b-5) receiving D m =h k (IV m ) as said updated in- 
itial value from said each participant device; 

said step (c) includes the steps of: is 

(c-1) publishing all of its received D m 's on said 
bulletin board; 

(c-2) generating h(D m )'s for all of said D m 's; 
(c-3) checking whether said h(D m )*s match said 20 
verification information C m 's on said bulletin 
board, respectively; 

(c-4) if no mismatch is detected in said step (c- 
3), generating g(Dj) for Dj presented by said 
participant device j having sent said maximum 2s 
aimed value determined in said step (b-4); and 
(c-5) checking whether said g(Dj) matches said 
aimed value information f } of said participant 
device j on said bulletin board; and 

30 

said step (d) includes a step of deciding that 
said participant device j sent said aimed value in- 
formation for said aimed value k, if a match is de- 
tected in said step (c-5). 

35 

71. The recording medium of claim 70, wherein said 
step (d) includes the steps of: 

(d-1) generating E m = 9(^^(1 VJ) for t such 
that k<t<K and for all of said m's except said j; 40 
(d-2) checking whether these E m 's match said 
aimed value information y m on said bulletin 
board; and 

(d-3) if no match is detected in said step (d-2), 
deciding that said k is an index corresponding 45 
to the maximum or minimum aimed value, and 
outputting said k and said identifier ID m of said 
participant device j having presented said 
aimed value. 

so 

72. The recording medium of claim 70 or 71 , wherein 

said step (b-2) includes a step of requesting 
all of said participant devices to present additional 
information l m as well as said aimed value PR m and 
said random number R m 56 

73. A recording medium on which there is recorded as 
a program the procedure which is followed by a 



server device in a quantitative competition method 
for a system in which a plurality of participant devic- 
es send their aimed values to said server device 
and said server device determines which of said 
participant devices has offered the maximum or 
minimum one of said aimed values received, and 
there is provided a conversion table showing the re- 
lationships between a sequence of values selecta- 
ble as said aimed values and a sequence of indexes 
k of integral values respectively corresponding 
thereto, said procedure comprising the steps of: 

(a) receiving, from each of participant devices, 
n ( H m (K) ) generated as aimed value information 
of said each participant device by repeating, for 
each of a sequence of index values k from at 
least k^ corresponding to an aimed value of 
said each participant device to an upper limit 
index value K. processing of: 

combining an initial value of said each par- 
ticipant device with select information to 
provide combined information and 
operating a one-way function h on said 
combined information to generate an up- 
dated value, said select information indi- 
cating whether said each index value k is 
an aimed value or not, and 
publishing said aimed value information h 
(H^K)) on a bulletin board accessible from 
all of said participant devices and any other 
devices as well; 

(b) requesting said each participant device to 
send an updated initial value {H m ( k - 1 ), b m M} 
corresponding to each value of said index k in 
descending order from K; 

(c) publishing said updated initial value {H^" 1 ), 
b m < k )} on said bulletin board; 

(d) processing said updated initial value 
{H m < k - 1 ), b m ( k )} with said one-way function h to 
generate H m < k > = h(H JMflbJW); 

(e) checking whether said updated initial value 
H m ( k > matches H ra W in {H m W, b m < k+1 >} received 
previously; and 

(f) if a match is detected in said step (e), decid- 
ing whether said select information b m ( k > repre- 
sents that the corresponding index k is the in- 
dex k^, of said aimed value; and 

(g) if the result of decision in said step (f ) is true, 
outputting said index k concerned and the cor- 
responding participant device number m, and if 
the result of decision is false, said server device 
returns to said step (b) and repeats processing 
for the next index value k. 

74. A recording medium on which there is recorded as 
a program the procedure which is followed by a 
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server device in a quantitative competition method 
for a system in which a plurality of participant devic- 
es send their aimed values to said server device 
and said server device determines which of said 
participant devices has offered the maximum or s 
minimum one-of said aimed values received, and 
there is provided a conversion table showing the re- 
lationships between a sequence of values selecta- 
ble as said aimed values and a sequence of indexes 
k of integral values respectively corresponding io 
thereto, said procedure comprising the steps 
wherein said server device: 

(a) receives as said aimed value informa- 
tion from said each participant device which, is 
upon each processing of said initial value with 
said one-way function h, generates an updated 
initial value by adding said processed initial val- 
ue with select information b^) indicating 
whether said processed initial value is an aimed 20 
value for one value of said index k, and gener- 
ates H m ^> by repeatedly performing this 
processing from at least that index ^ of a se- 
quence of indexes which corresponds to said 
aimed value to the upper limit value K, and pub- 25 
lishes said aimed value information H m W on a 
bulletin board accessible from all of said partic- 
ipant device; 

(b) for each value of said index k in order de- 
scending from K, inquires said each participant 30 
device about whether it has bid for said index 

k, said each participant device responding YES 
or NO to said inquiry; 

(c) upon first detection of the response YES, 
requests said each participant device to send 35 
its updated initial value H m ( k_1 >; and 

(d) receives Hj* 1 ) = h(H m < k - 2 )||b m < k - 1 )) as said 
updated initial value from said each participant 
device and publishes said received updated in- 
itial value on said bulletin board; *o 

(e) letting a and a represent predetermined val- 
ues of said select information b^ indicating 
bidding and not bidding, respectively, gener- 
ates, for said participant device m having bid 

for the current index k, 45 

H m = h(...h(h(H m (k - 1) ||a)||a)..;||a) 

through the use of said updated initial value so 
H m < k_1 ), and for every one of the other partici- 
pant devices m, generates 

H m = h(.„h(h(H m (k - 1) ||a)i|a)...||a) ss 
through the use of said updated initial values 



(f) checks whether said H m for said each par- 
ticipant device matches said H m < k > published on 
said bulletin board; and 

(g) if a match is detected in said step (f), deter- 
mines that said participant device having re- 
sponded YES is the winning bidding device, 
and publishes the current value of said index k 
as the index !<„, of the aimed value of said win- 
ning bidding device. 

75. A recording medium on which there is recorded as 
a program the procedure which is followed by a 
server device in a quantitative competition method 
for a system in which a plurality of participant devic- 
es send their aimed values to said server device 
and said server device determines which of said 
participant devices has offered the maximum or 
minimum one of said aimed values received, and 
there is provided a conversion table showing the re- 
lationships between a sequence of values selecta- 
ble as said aimed values and a sequence of indexes 
k of integral values respectively corresponding 
thereto, said procedure comprising the steps of: 

(a) letting the initial value of said each partici- 
pant device be represented by IV m> receiving 
from said each participant device H^*) = h K km 
(g xm (l V m )) generated as said aimed value infor- 
mation using a predetermined positive integer 
x m , said initial value I V m and one-way functions 
h and g; 

(b) publishing said aimed value information 
on a bulletin board accessible from all of said 
participant devices; and 

(c) sending said index k to said each participant 
device to ask for its updated initial value; 

t (d) processing said updated initial value H m ( k1 > 
with said one-way function h to generate h 

(e) deciding whether said h(H m ( k " 1 )) is equal to 
said aimed value information H^*); 

(f) if it is decided in said step (e) that they are 
equal, updating said aimed value information 
H m W with said updated initial value H m < k ~ 1 >, 
then decrementing said index k by one and re- 
turning to said step (c); 

(g) if it is decided in said step (e) that they are 
not equal, processing said updated initial value 
H m ( k " 1 ) with said one-way function g to generate 
g(H m ( k -i>); and 

(h) deciding whether said g(H m ( k_1 )) matches 
said aimed value information H m < K ); and 

(i) deciding that the aimed value of said partic- 
ipant device corresponding to m and k having 
provided said match is the maximum or mini- 
mum, if a match is detected in said step (h). 

76. A recording medium on which there is recorded as 
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a program the procedure which is fol towed by a 
server device in a quantitative competition method 
for a system in which a plurality of participant devic- 
es send their aimed values to said server device 
and said server device determines which of said 5 
participant devices has offered the maximum or 
minimum one of said aimed values received, and 
there is provided a conversion table showing the re- 
lationships between a sequence of values selecta- 
ble as said aimed values and a sequence of indexes 10 
k of integral values respectively corresponding 
thereto, said procedure comprising the steps 
wherein said server device: 



77. A recording medium on which there is recorded as 
a program the procedure which is followed by a 
server device in a quantitative competition method 
for a system in which a plurality of participant devic- 
es send their aimed values to said server device 
and said server device determines which of said 
participant devices has offered the maximum or 
minimum one of said aimed values received, and 
there is provided a conversion table sh6wingthe re- 
lationships between a sequence of values selecta- 
ble as said aimed values and a sequence of indexes 
k of integral values respectively corresponding 
thereto, said procedure comprising the steps of: 



(a) , letting the initial value of said each partici- is 
pant device be represented by IV m , where m = 

1 , 2, M, M being an integer equal to or great- 
er than 2, receives from each participant de- 
vice, as said aimed value information, H m W = 
n K-km(gxm(| v m jj using a predetermined positive 20 
integer x^, said initial, value IV m and one-way 
functions h and g, and publishes said received 
aimed value information on a bulletin board ac- 
cessible from all of said participant devices; 

(b) for each value of said index k in order de- 25 
scendingfrom K, inquires said each participant 
device about whether it has bid for said index 

k, said each participant device responding YES 
or NO to said inquiry; 

(c) upon first detection of the response YES, 30 
requests said each participant device to send 

its updated initial value H m < k_1 ); 

(d) receives from said each participant device 
Hm <k-1> = gxm-i (IVni ) jf k = l^ and H m M) = 

h k-km-1 (g xm (|Vm)) if k^l^; 35 

(e) for said updated initial value H^ -1 ) re- 
ceived from said participant device having re- 
sponded YES, generates 

and for said updated initial value received from 
said each participant device having responded 
NO, generates 45 

H m = h™*g(H m <">) 

(f) checks whether said H m for said each par- so 
ticipant device matches said H m W published 

on said bulletin board; and 

(g) if a match is detected in said step (f), deter- 
mines that said participant device having re- 
sponded YES is the winning bidding device, 55 
and publishes the current value of said index k 

as the index K m of the aimed value of said win- 
ning bidding device. 



(a) letting the initial value of said each partici- 
pant device be represented by IV m , receiving 
from said each participant device H m ( K > = h Kkm 
(gxm(j v m )) generated as said aimed value infor- 
mation using a predetermined positive integer 
Xjn, said initial value IV m and one-way functions 
h and g; 

(b) publishing said aimed value information 
H^W on a bulletin board accessible from all of 
said participant devices; and 

(c) sending said index k to said each participant 
device to ask for its updated initial value;. 

(d) checking whether its received updated ini- 
tial value H k m is added with said flag; 

(e) if it is decided in said step (d) that said flag 
is added, processing said updated initial value 
H m ( k_1 ) with said one-way function g to generate 

g(H m < k - 1 >); 

(f) deciding whether said g(H m ( k_1 )) matches 
said aimed value information H^); 

(g) if it is decided in said step (d) that no flag is 
added, processing said updated initial value 
H m ( k_1 ) with said one-way function h to generate 
h(H m ( k -i>); 

(h) deciding whether said h(H m ( k_1 )) matches 
said aimed value information H m W; 

(i) if it is decided in said step that they are equal, 
updating said aimed value information H m W 
with said initial value H m < k1 >, then decrement- 
ing said index k by one and returning to said 
step (c); and 

(j) if it is decided in said step (h), processing 
said initial value H m < k " 1 ) with said one-way func- 
tion g to generate g(H m ( k1 )) and returning to 
said step (f); and 

(k) if a match is detected in said step (f), decid- 
ing that the aimed value of said participant de- 
vice corresponding to m and k having provided 
said match is the maximum or minimum. 

A recording medium on which there is recorded as 
a program the procedure which is followed by a 
server device in a quantitative competition method 
for a system in which a plurality of participant devic- 
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es send their aimed values to said server device 
and said server device determines which of said 
participant devices has offered the maximum or 
minimum one of said aimed values received, and 
there is provided a conversion table showing the re- s 
lationships between a sequence of values selecta- 
ble as said aimed values and a sequence of indexes 
k of integral values respectively corresponding 
thereto, and m = 1, 2, .... M, M being an integer 
equal to or greater than 2; said procedure compris- 10 
ing the steps of: 

(a) receiving from each of said participant de- 
vices at least pieces of aimed value in- 
formation h(k(+)b m ( k )(+)R m 0<)) generated by 15 
processing, with a predetermined one-way 
function h and through the use of said conver- 
sion table, information kf+Jb^f+JF^W, which 
contains each index k equal to or larger than an 
index !<„, corresponding to said aimed value, 20 
select information b m < k > indicating whether said 
index k corresponds to said aimed value, and 

a random number R m < k >, A(+)B representing a 
predetermined arbitrary operation between A 
and B; 25 

(b) receiving and publishing said aimed value 
information on a bulletin board accessible from 
all of said participant devices; 

(c) obtaining said random number R m corre- 
sponding to each of said sequence of indexes 30 
k; 

(d) calculating h(k(+)a(+)R m < k )), where a is a 
predetermined value with which said select in- 
formation b ra < k ) indicates said aimed value; 

(e) checking said aimed values on said bulletin 35 
board for matching with said calculated h(k(+) 
a( + )R m 0O); and 

(f ) if a match is detected in said step (e), decid- 
ing that the aimed value of the aimed value in- 
formation of a participant device having sent 40 
said random number F^OO at that time is the 
maximum or minimum value. 

79. The recording medium of claim 78, wherein said 
procedure further comprises a step of repeating 4S 
said steps (c), (d) and (e) if a match is detected in 
said step (d). 

80. The recording medium of claim 79, wherein said 
step (c) includes the steps of: requesting said each so 
participant device to send said random number 
R m ( k ) corresponding to said index k; and receiving 
said random number F^W from said each partici- 
pant device. 

55 

81. The recording medium of claim 79, wherein: 

said step (a) includes a step of receiving said 



random number R m < k ) sent from said each par- 
ticipant device together with said aimed value 
information h(k(+)b rn < k >(+)R m ( k >); 
said step (b) includes a step of storing said ran- 
dom number R^M in a nonpublic memory; and 
said step (c) includes the steps of: requesting 
said each participant device to send said ran- 
dom number R m ( k ) corresponding to said index 
k; and receiving said random number F^M 
from said each participant device. 

82. The recording medium of claim 63, 64, 69, 70, 73, 
74, 75, 76, 77 or 78, wherein said sequences of in- 
dexes k and values selectable as said aimed values 
are both monotonous increasing values- in the 
same direction, and in said step (c) said server de- 
vice determines the maximum aimed value. 

83. The recording medium of claim 63, 64, 69, 70, 73, 
74, 75, 76, 77 or 78, wherein said sequences of in- 
dexes k and values selectable as said aimed values 
are Both monotonous increasing values in opposite 
directions, and in said step (c) said server device 
determines the minimum aimed value. 

84. The recording medium of claim 63, 64, 69, 70, 73, 
74, 75, 76, 77 or 78, wherein let an arbitrary aimed 
value be represented by PR = F(k)+Q, where F(k) 
is a value in said conversion table corresponding to 
said index k and Q is a fraction which is a positive 
integer which satisfies F(k+1 )-F(k)>Q>0; 

said step (a) includes a step wherein, letting 
said aimed value PF^ of said each participant 
device m be represented by PR m = Ffk^+Q^,, 
said server device receives from each partici- 
pant device m said aimed value information 
generated by processing said initial value with 
said one-way function h by the number of times 
conesponding to k^, together with said fraction 
Qro, where m = 1, 2, ... M, said M being an in- 
teger equal to or greater than 2, and said server 
device publishes said aimed value information 
and said fraction Q m on a bulletin board acces- 
sible from all of said participant devices; 
said step (c) includes a step where said server 
device makes a check for matching between 
said updated initial value and said aimed value 
information for each index value in an ascend- 
ing or descending order of said fraction 
where m = 1, 2, .... M; and 
said step (d) includes a step wherein, upon first 
detection of a match in said step (c), said server 
device finishes said check and determines, 
from k m and m at the time of detecting the 
match, that PR m = F(k fI1 )+Q m is said maximum 
or minimum aimed value. 
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85. The recording medium of claim 78 or 79, wherein 
let an arbitrary aimed value be represented by PR 
- F(k)-fQ, where F(k) is a value in said conversion 
table corresponding to said index k and Q is a frac- 
tion which is a positive integer which satisfies F s 
(k+1)-F(k)>Q>0; 

said step (a) includes a step wherein, letting 
said aimed value PR m of said each participant 
device m be represented by PF^ = Ffk^+Q,,,, 10 
said server device receives said fraction to- 
gether with said aimed value information; 
said step (b) includes a step of publishing said 
fraction Q m on said bulletin board together with 
said aimed value information, where m = 1, is 
2, .... M, said M being an integer equal to or 
greater than 2; 

said step (e) includes a step of making said 
check for matching for each index value in an 
ascending or descending order of said fraction 20 
Q m where m = 1, 2, M; and 
said step (f) includes a step wherein, upon first 
detection of a match in said step (c), said server 
device finishes said check and determines, 
from l^ and m at the time of detecting the 25 
match, that PR m - F(k fn )tQ m is said maximum 
or minimum aimed value. 

86. A quantitative competition system which comprises 

a server device and M participant devices each con- 30 
nected via a communication channel to said server 
device and in which said M participant devices send 
their aimed values to said server device and said 
server device determines which of said M partici- 
pant devices has offered the maximum or minimum 3S 
one of said aimed values received, 

each of said participant devices comprising: 

aimed value generating means for generating 
an aimed value PR^ 40 
aimed value transforming means provided with 
a conversion table memory having stored 
therein a conversion table which defines the re- 
lationships between a sequence of values se- 
lectable as said aimed values and a sequence *s 
of indexes corresponding thereto, for convert- 
ing said aimed value PR m to the corresponding 
index \^ and which processes said aimed val- 
ue with a predetermined one-way function by 
the number of times corresponding to said so 
aimed value to obtain aimed value information; 
and 

sending means for sending to said server de- 
vice said aimed value information and an iden- 
tifier identifying said participant device; and ss 
said server device comprising: 
a conversion table memory which has stored 
therein a conversion table which is the same as 



said conversion table; 

a bulletin board on which said server device 
writes said aimed value information an identifier 
received from said each participant device; 
updated initial value acquiring means which ac- 
quires an updated initial value obtained by 
processing said initial value with a one-way 
function repeatedly in correspondence with val- 
ues of an index k which is a predetermined con- 
secutive positive integers; 
a counter which updates said index k one by 
one; and 

control means which, upon each updating of 
said index k, compares said updated initial val- 
ue with said aimed value information on said 
bulletin board to check whether they match, 
and determines m and k at the time of first de- 
tection of a match. 

87. The system of claim 86, wherein said each partici- 
pant device has initial value updating means for 
processing said initial value with a oneOway func- 
tion h to generate an updated initial value and for 
sending said updated initial value to said server de- 
vice, and said updated initial value acquiring means 
of said server device receives said updated initial 
value from said each participant device. 

88. The system of claim 86, wherein said updated initial 
value acquiring means of said server device proc- 
esses said initial value with a one-way function h to 
generate said updated initial value. 

89. The system of claim 87 or 88, wherein said aimed 
value transformer of said each participant device 
comprises: 

a one-way function h processor which process- 
es an initial value IV m inherent to said partici- 
pant device with a one-way function h by the 
number of times corresponding to said index ^ 
to obtain an output h km (IV m ); and 
a one-way function g processor which process- 
es said output from said one-way function h 
processor with a one-way function g to obtain 
said aimed value information. 

90. The system of claim 89, wherein said aimed value 
transformer of said each participant device includes 
verification information generating means for 
processing said initial value IV m with said one-way 
function h by K+1 times to generate C m = h K+1 (IV m ) 
as verification information and for sending said ver- 
ification information to said server device; 

wherein there is published on said bulletin 
board C m = h K+1 (IV m ) received from said each 
participant device in advance, said server de- 
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vice further comprising a one-way function h 
processor which processes said response D m 
with a one-way function h to generate h(D m ), 
and 

wherein said control means checks whether C m 5 
= h(D m ) holds, and if not, rewrites said C m with 
said D m and updates said index k on said coun- 
ter. 

91. The system of claim 86, wherein said each partici- 10 
pant device comprises: 

a random generator for generating a random 
number R m ; 

an operating device for operating said random is 
number R m and said aimed value PF^ to obtain 
PR m (+)R m , where (+) represents a predeter- 
mined arbitrary operation; 
one-way function h processing means for 
processing said PR^)!^ with a one-way 20 
function h to obtain h(PR m (+)R m ); and 
verification information generating means for 
processing said initial value I V m with said one- 
way function h K+1 times to generate C m - h K+1 
(IV m ); and wherein: 25 
said hfPRrof+JRro) and said verification infor- 
mation are sent to said server device together 
with said aimed value information; 
in said server device: 

there are published on said bulletin board C m 30 
- h K+1 (IV m ), said aimed value information y m = 
h k (IVJ and htPR^+JR,,,) received from said 
each participant device, said PF^ and said R m 
being an aimed value and a random number of 
said each participant device m; 35 
said control means decides the maximum or 
minimum aimed value from said aimed values 
PR m and said random numbers received 
from said participant devices, and determines 
the index k^ corresponding to said maximum 40 
or minimum aimed value and requests said 
each participant device to send (D m ) = h 1 *™* 
(I V m ) corresponding to said index k^; 
said updated initial value acquiring means com- 
prises a one-way function h processor for 45 
processing D m with a one-way function h to 
generate h K+1 - kmx (D m ), and a one-way function 
g processor for processing Dj with a one-way 
function g to generate g(Dj); and 
said control means makes a check to see if said so 
h K+1kmx (D m ) matches C m on said bulletin 
board and if said g(Dj) matches said Y m on said 
bu Noting board. 

92. The system of claim 86, wherein said aimed value 55 
transformer of said each participant device com- 
prises: 



a conversion table memory which has stored 
therein a conversion table which defines index- 
es k = 1, 2, K corresponding to K kinds of 
values selectable as aimed values; 
a select information generator which generates 
select information b m M indicating whether to 
select an aimed value corresponding to each of 
said indexes k = 1 , 2, .... K; 
a random generator which generates a random 
number R m fl<) inherent to said participant de- 
vice m and said index k; 
an operating device which receives said index 
k, said random number R m < k > and said select 
information b m < k > and performs an operation k 
( + )b m W( + )R m ( k ); 

a one-way function h processor which process- 
es said k(+)b m ( k )(+)R m < k ) with a one-way func- 
tion h to obtain h(k(+)b m < k )(+)R m < k )); and 
a control device which computes said h(k(+) 
b m ( k )(+)R m ( k )) for each of said indexes k and 
provides the k pieces information as said aimed 
value information; 
in said server device: 

there are published on said bulletin board h(k 
(+)b m ( k )(+)R fn ( k )) together with said aimed val- 
ue information y m received from said each par- 
ticipant device; 

said server device further comprises an opera- 
tor for operating k(+)b(+)R m < k ), and 
a one-way function h processor for processing 
the result of said operation with a one-way func- 
tion h to generate hfkf+Jbf+JRjnOO), where b is 
a predetermined value which indicates that said 
select information b m < k ) has selected the aimed 
value corresponding to said index k; and 
said control means makes a check for matching 
between said h(k(+)b(+)R m < k )) and said h(k(+) 
b m (k) (+)R m (k) ) on said bulletin board. 

93. The system of claim 86, wherein said aimed value 
transformer of said each participant device com- 
prises: 

a conversion table memory which has stored 
therein a conversion table which defines index- 
es k = 1, 2, .... K corresponding to K kinds of 
values selectable as aimed values, for convert- 
ing said aimed value PR m to the corresponding 
index k^; 

initial value updating means which, for each in- 
dex k, processes an initial value with a one-way 
function h and adds the processed initial value 
with select information b m W for said index k to 
obtain an updated initial value and repeats this 
processing until k = K is reached, thereby gen- 
erating H m tK>; 

a one-way function h processor for outputting 
said updated initial value H m < k > from said initial 
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value updating means as said aimed value in- 
formation; 

select information generator which generates 
said select information b m M whether said 
aimed value corresponds to each index k from s 
at least k,,, to K; 

a concatenator which concatenates said 
H m < k " 1 > from said one-way function h processor 
and said select information b m M to generate 
H m k =h(H m (k-i)||b m 00); 10 
a buffer which temporarily holds the output from 
said concatenator and outputs said output for 
the next value of said index k; 
a storage part which, for each value of said in- 
dex k, stores H m < k ) corresponding thereto; and 
a second one-way function h processor by 
which H m ( k ), obtained by repeating processing 
until k= K, is processed with a one-way function 
h to generate h(H m < k >), said h(H m M) being out- 
put as said aimed value information; 20 
wherein said sending means is a means which 
responds to a request of said server device for 
said index k to read out H m ( k > from said storage 
part and send said H m W to said server device; 

25 

in said server device: 

there are published on said bulletin board, as 
said aimed value information, h(H m ( k >) obtained 
by processing, with a one-way function h, H m ( k > 30 
generated by said each participant device 
which, upon each processing of said initial val- 
ue with a one-way function h, added the proc- 
essed value with select information bJM indi- 
cating whether said value was an aimed value 35 
for each value of said index k and repeated this 
processing from at least the index !<„, corre- 
sponding to said aimed value to the upper limit 
value K of said index k; 

said initial value updating means includes a 40 
one-way function h processor by which 
{H m ( k * 1 ), b m } received from said each partici- 
pant device in answer to an inquiry for said in- 
dex k is processed with a one-y function h to 
generate H m < k > = h(H m ( k 'i )Hb m < k >); and 45 
said server device includes an updated initial 
value comparator for making a check to see if 
said Hjx) matches H m 0<) in {H m < k >. b m ( k+1 >} pre- 
viously received. 

so 

94. The system of claim 86, wherein said aimed value 
transformer of said each participant device com- 
prises: 

a conversion table memory which has stored 55 
therein a conversion table which defines index- 
es k - 1, 2, K corresponding to K kinds of 
values selectable as aimed values, for convert- 



ing said aimed value PR m to the corresponding 
index k^; 

a one-way function g processor which process- 
es said initial value I V m with a one-way function 
g by a predetermined number of times ^ to 
generate g xm (I V m ); 

a one-way function h processor which process- 
es said g xm (IV m ) with a one-way function h K- 
k™ times to generate H m W = h*-*^*^!^)) 
as said aimed value information; and 
response generating means which responds to 
a request from said server device for k to decide 
whether k^k,,,, and if true, generates H^" 1 ) = 
hk-km-1 (g xm (IV m )), and if false, generates 
H m < k -i> = g*^(IV m );and 
wherein said sending means sends said H m ( k1 ) 
in response to said request from said server de- 
vice for said k; and 

in said server device: 

there is published on said bulletin board H^W 
= hK-^fg^O V m )) as said aimed value informa- 
tion received from said each participant device, 
which further comprises a one-way function h 
processor by which H m < k " 1 ) received from said 
each participant device as an answer to an in- 
quiry for said k is processed with a one-way 
function h to generate h(H m ( k1 ), and a one-way 
function g processor for processing said an- 
swer H m < k ~ 1 ) with a one-way function g to gen- 
erate g(H m ( k ' 1 )); and 

said control means: makes a check to see if 
said h(H m ( k " 1 )) matches said aimed value infor- 
mation H^K) published on said bulletin board; 
if a match is detected, updates said aimed val- 
ue information with said H^" 1 ) and dec- 
rements said index k on said counter by one; 
and if a mismatch is detected, makes a check 
to see if said g(H m ( k * 1 )) matches said aimed val- 
ue information H m ( K ); and if a match is detected, 
determines, based on k and m at that time, the 
maximum or minimum aimed value PR m and 
the participant device m having offered said val- 
ue PR m . 

95. The system of claim 86, 87, 88, 91, 92, 93 or 94, 
wherein said aimed value transformer of said each 
participant device comprises; 

a conversion table memory which has stored 
therein a conversion table which defines the re- 
lationships between a sequence of values se- 
lectable as said aimed values and a sequence 
of indexes k of integral values respectively cor- 
responding thereto, for converting said aimed 
value PR m to the corresponding index k^ t 
a fraction calculating part which, letting an ar- 
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bitrary aimed value PR be represented by PR 
= F(k)+Q, where F(k) is a value in said conver- 
sion table corresponding to said k and Q is a 
fraction which is a positive integer which satis- 
fies F(k+1 )-F(k)>Q>0, calculates said fraction s 
Q m = PR rn -F(k m ) based on F^) obtained from 
said conversion table and said aimed value 
PR m ; and 

a one-way function h processor which process- 
es said initial value I V m with said one-way f unc- io 
tion h by the number of times corresponding to 
said 1^ to generate said aimed value informa- 
tion; and 

wherein said sending means sends said frac- 
tion Q m to said server device together with said is 
aimed value information; and 
in said server device; 

there is published on said bulletin board said 
fraction Q m received from said each participant de- 20 
vice together with said aimed value information; and 
said server device comprises: 

a sequencer for deciding the sequence of said 
fractions Q m on said bulletin board; and 25 
select information comparator for checking 
whether said select information b^) is equal 
to a value b indicating the selection of the aimed 
value corresponding to said index k in said de- 
cided sequence of fractions Q^,. 30 

96. The system of claims 86, 87, 88, 91, 92, 93 or 94, 
wherein said sequence of index values k and said 
sequence of values selectable as saidaimed values 

on said conversion table are monotone increasing 35 
values in the same direction, and said server device 
determines the maximum aimed value. 

97. The system of claims 86, 87, 88, 91 , 92, 93 or 94, 
wherein said sequence of index values k and said 40 
sequence of values selectable as said aimed values 

on said conversion table are monotone increasing 
values in opposite directions, and said server de- 
vice determines the minimum aimed value. 
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